Crinul, you are stretching here. It's ON OPEN not ON QUERY. A query is a private msg, or a /msg. /query <nick> <msg> opens a window. It should call the ON OPEN event.

Who is going to use ON OPEN for flood detection? Once the query window is open ON OPEN is not called again. (Actually I have not tested this... omigod please tell me it doesn't call ON OPEN whenever you get a private query!)

The help file is also incorrect.

Format: on <level>:OPEN|CLOSE:<?|@|=|!|*>:<matchtext>:<commands>

OPEN and CLOSE are not identical... they should be but they are not.

Beware of MeStinkBAD! He knows more than he actually does!