A lot of spammers use rotating IP addresses (via proxy or VPNs) for their spam messages. So it could be that they were able to submit more comments using a new/different IP address that wasn’t blocked.
It also could be that there is some conflict with another plugin or maybe something the theme is doing that is preventing normal functionality. Without investigating things, it is difficult to guess at what might be happening.
In any case, if the plugin is not working out for you, best advice is to either do some basic troubleshooting, or just move on to one of the other amazing security plugins out there, so many great ones available that can block bots or whatever you are dealing with. Note: I would be glad to provide a free troubleshooting guide if it might be useful for you.
Let me know how I can help.