It says in the AIV header that warnings must be recent (bolded). IP was last warned 20 days ago (sorry, I know I put 11, I miscounted). 20 days isn't recent, so yes, in theory your logic statement is correct. IPs are used by several different people so it would be unfair to penalise them all. Besides, this wasn't even blatant vandalism, if vandalism at all. Maybe an errant test edit, but anyway enough to merit a level 1 warning in any case. If you look through the archives at WPT:AIV, you may find a thread on what "recent" means – there have been several in the past. – B.hotep •talk•