How are some bots able to bypass the message limit?

I think a whitelist would be a pretty good idea for this kind of thing.