For that to would you would have to have /ial on
and the nick would have to, and always have while in DCC chat without a common channel with you (bot).

Would be better to use $address($nick,5) or $ial($nick) to get the full address. Then pass that to $level()

However, I would recommend a custom login system, make it so they have to quote a username and password when they login. This will be more secure.

Even though address mask access levels is pretty insecure most of the time anyway...

Remember that if you send a chat request to someone. Someone else could nip in there and connect before they get there. Though the chances are remote, as they'd have to know you have a dcc port open waiting, and also need to know the IP and port to connect to.

But it would be a possible security exploit having it the way you have it.

The login would be very easy to do, safer, and would work when they don't have a common channel with the bot.