Confusing spam threshold host error message

I’m posting this here because it’s something that had me puzzled for a while. When a new user creates multiple posts that contain links to the same domain, all of their posts may be hidden due to the newuser spam host threshold setting. There are two things that confused me about this behaviour.

The first issue is that either the setting’s copy or its implementation seems to be off. The copy says:

How many times a new user can post a link to the same host within their newuser_spam_host_threshold posts before being considered spam.

I interpret this to mean that with the default setting of 3 posts, the user can create three posts with links to the same domain. When I test this on my site, the user can only create 2 posts with links to the same domain. Based of the description, I would expect the user to be able to create 3 posts and have the spam flags triggered by their 4th post.

The second issue is with the message that is shown to admins for the review item:

This new user tried to create multiple posts with links to the same domain. All posts from this user that include links should be reviewed. See the newuser_spam_host_threshold site setting.

The post that triggered the spam threshold is never created. When the user attempts to create it, it is blocked with this error message:

When looking into an issue related to this, it was unclear to me why the threshold was being triggered because the post that actually triggered the issue doesn’t get added to the review queue. This is especially confusing on sites that have set their newuser spam host threshold to 2 posts. In that case, only a single post shows up in the review queue and it’s hard to know why it is there.