Same idea tho, every time they query you, you set a variable with the users host that will automatically unset itself in a given amount of seconds, say 3, then every time a query comes in you make sure there arent any variables matching that users host, if there aren't then you know its the first message or the time (3 sec) has passed so you allow it, if the variable does exist you know its a second msg within the 3 seconds so you can ignore it or make it so second message = warning and 3rd message = ignore or however you want.

Does that make enough sense?