Update again, root and lxlabs will never be blocked, or even hold a count.
Second, this is a KloxoMR bug, it is not sending the message to sendmail. I turned on sendmail logging, (4) and the first entry is from panel, but it didn't send a message with it, right after is csf sending mail concerning my SSH login.
So, this is KloxoMR bug, not my script.
[Wed, 05 Feb 2014 11:20:36 -0500] /usr/local/lxlabs/kloxo/httpdocs - lxlabs:498 / (OK)
sendmail called using args: -t -i
[Wed, 05 Feb 2014 11:20:53 -0500] /root - root:0 / (OK)
sendmail called using args: -f root -t
From: root
To: <removed>@gmail.com
Subject: lfd on server: SSH login alert for user root from x.x.x.x (US/United States)
The second message gets delivered, because there IS a message, the panel message contains no body. It doesn't have anything to send, therefore, no mail logs.