Case in point: [[ https://en.wikipedia.org/w/index.php?title=Special:AbuseLog&wpSearchFilter=637&offset=20170623144800&limit=1 | this entry ]] which is for [[ https://en.wikipedia.org/w/index.php?title=Diarmuid_Johnson&diff=prev&oldid=787116653 | this diff ]] does NOT match the regex at that point in time:
user_age == 0 &
edit_delta < 5 &
edit_delta > -5 &
added_lines rlike "^[\n\s]+$"
Indeed, if you [[ https://en.wikipedia.org/wiki/Special:AbuseFilter/examine/955398370 | exame it ]] and run the regex there, it does not match. Compare with [[ https://en.wikipedia.org/wiki/Special:AbuseLog/18775762 | Special:AbuseLog/18775762 ]] (for the same edit) and you'll see the variables are all wrong. THis apparently is what AbuseFilter is going off of. For example, the `edit_delta` (net change) is listed as `1`, but looking at the [[ https://en.wikipedia.org/wiki/Special:Contributions/220.127.116.11 | contributions ]] of the IP (or the page's [[ https://en.wikipedia.org/w/index.php?title=Diarmuid_Johnson&action=history | revision history ]]), there aren't any that were +1 in size. If you compare the UNIX timestamp you'll see the date matches up, so it at least thinks it's for the same edit.
I spot-checked some filters on enwiki and they don't seem to be malfunctioning like this, but there could be others.