Not sure if it is a bug but I want an admin to look into it.
A close friend of mine shared his API key with me so that i can look into his account and advice him. Or probably he was bluffing and shared the wrong key. I entered his key in api.torn.com
First time it said "Incorrect Key" as expected. I entered the api key again thinking i made some mistake and on the second attempt itself I got "IP block".
Certainly it wasn't an abuse and probably the number of attempts can be increased before you get IP block.