Failtoban max retry set to 3, email alerts show 40+ attempts

Is this normal or do I have an issue(s) I need to address?

I’m using the gui via the admin module with the following settings.

Ban Time: 3600
Max Retry: 3
Find Time: 300
E-mail:
Whitelist
127.0.0.1
"Internal subnet range"
“SIP Provider IP”