Before switching to OOUI, the throttle groups were specified in a raw textarea with no validation on it (sigh!) and this led to many curious situations. Some of them are already being handled in related tasks, but two aren't:
# Groups may be empty. This causes the filter not to throttle at all (groups are required), and is also responsible of T203535 and of PHP warning and notices shown (amongst the others) in AbuseFilter history.
# Groups may have duplicates. I didn't completely assess the potential troubles here, but I guess that a single action would count as 2 for that group (since the increment is performed twice). I may be wrong, though.
The empty case must be handled separately, and I'd like to hear some thoughts about how. We could write a maintenance script to convert it to "user" (should be the default), but this could break filter history. An alternative would to emit some kind of warning (wfWarn?) for some time, then throw an exception in a future MW release.
The duplicate case can instead be handled inside the maintenance script for T203353, since it's a non controversial thing.