It does log IPs and you can optionally stop an IP from reposting and release it via a cron job. Right now it just throttles it every 30 seconds. People aren't going to use it as spam because they have to enter their credentials. They wouldn't want to spam their own accounts, right? If they use a proxy, then can send a tweet just the same. Try and send a tweet to see how it works.