This is for 4 joins in 4 seconds:

Code:
on @*:join:#:{
  inc -z %joins. $+ # 4
  if (%joins. [ $+ [ # ] ] > 12) {
    msg # Possible clone attack
    mode # +MRiN
    .timer 1 300 mode # -MRiN
    unset %joins. $+ #
  }
}


With /inc -u4 checking the var is > 4 it would trigger for 4 joins in up to 16 seconds