The script that adds the shout to the database does check for bans. If it is a registered user it checks the username making the shout. If not a registered user it uses the IP address to check against the bans. Dynamic IP addresses are the majority on the net. ISP's such as AOL complicate this with proxies.
I added a check against the postername variable being used to see if that too is banned. I think the best way to handle it though would be to disallow nonregistered users from using the shout box and then banning by username may tire them out.
