When a customer profile is created, the payment details are validated by sending through a transaction, if validationMode is set to liveMode. This transaction is not subject to IP address filtering as this cannot be set when creating a customer. This can create a situation where the account can be locked due to the fraud, which should be blocked by IP Address filtering.
See also issue raised here
