Just a short analysis.
In theory it is possible that a single IRC server mixes replies for one command with other messages. For example, ircu sends the replies to the LIST command in batches, mixed with other traffic, to prevent flooding the user. However, in practice it is unlikely that this concept will ever be applied to the WHOIS command: it is simply much easier to generate and buffer the entire, typically reasonably small WHOIS output at once.
In practice it is also possible, namely when performing remote WHOIS queries. In this case, the remote numeric replies for a WHOIS may be interspersed with basically any other numeric replies, the latter typically coming from the local server. To make things worse, the message source may be the same for all these messages, if the network chooses to hide its individual servers' names. Undernet and QuakeNet do this, for example.
So this really is about a tradeoff. What is more likely, and which is worse? Numerics accidentally being recognized as being part of a whois (i.e. false positives) or numerics NOT being recognized as such (i.e. false negatives)? Like argv, I'd probably take a different decision here, but either decision can be justified..
