If you currently look at the logs, it would look like I'm editing from a StopForumSpam listed IP (I'm not), and then being exempt due to the order of operations.

Looking at a similar extension, namely MediaWiki-extensions-TorBlock, the code does the check for an exit IP pretty early:

	private static function checkUserCan( User $user, $action = null ) {
		global $wgTorAllowedActions, $wgRequest;

		if ( ( $action !== null && in_array( $action, $wgTorAllowedActions ) )
			|| !TorExitNodes::isExitNode()
		) {
			return true;
		}

It feels we should move

		$denyListManager = DenyListManager::singleton();
		if ( !$denyListManager->isIpDenyListed( $ip ) ) {
			return true;
		}

earlier, possibly after the early cheap checks, but before we do the other exemptions after $logger = LoggerFactory::getInstance( 'StopForumSpam' );