Failtoban max retry set to 3, email alerts show 40+ attempts

Is this normal or do I have an issue(s) I need to address?

I’m using the gui via the admin module with the following settings.

Ban Time: 3600
Max Retry: 3
Find Time: 300
"Internal subnet range"
“SIP Provider IP”