Change audit log SQL to accurately rate limit

Two changes:

1. Comparison operator was incorrect, should have been greater than
instead of less than.

2. Restrict results to those of the same student, otherwise we will be
imposing an overall rate limit (which may be sensible, but not 30
emails/hour).