We got a complaint that a user didn't like our filter message. User added 1 external link to an article and got a warning he was spamming Wikipedia with links. The filterlog shows the filter being triggered: //nl.wikipedia.org/wiki/Speciaal:Filterlogboek?wpSearchUser=220.127.116.11&wpSearchFilter=&wpSearchTitle=Slaapapneu. When checking the filtersettings it shows that the user should be allowed to add 3 links within 1800 seconds. The log of the user shows the user only made 1 edit on Wikipedia. I've checked with out filtereditors and they can't find an error.
I think the problem is in the difference between triggering the filter and applying an action. The warning is shown after the filter is triggered (which happens when a link is added), while the action (in this case: marking for later review) is only applied after three triggers in half an hour.
As a workaround, one might consider renaming the filter from 'Linkspam' to 'Veel nieuwe externe links', and atapting the template a bit, to be less likely to provoke anger from a good-faith author.
The filter will only match if a rate limit is tripped. You can specify the number of actions to allow, the period of time in which these actions must occur, and how those actions are grouped.
My understanding is that "warning" may be considered an action as well. Maybe we need to make it more clear in the interface to what actions the Throttling affects, by grouping them or something similar.