Crinul, you are stretching here. It's ON OPEN not ON QUERY. A query is a private msg, or a /msg. /query <nick> <msg> opens a window. It should call the ON OPEN event.
Who is going to use ON OPEN for flood detection? Once the query window is open ON OPEN is not called again. (Actually I have not tested this... omigod please tell me it doesn't call ON OPEN whenever you get a private query!)
The help file is also incorrect.
Format: on <level>:OPEN|CLOSE:<?|@|=|!|*>:<matchtext>:<commands>
OPEN and CLOSE are not identical... they should be but they are not.
