Hi,
The limit mechanism bases itself on the user entry and the user session.
So when the user is not logged in, the limit will apply to the session. If the user gets a new session, then the limit system won't be able to know it is the same person and thus the limit will apply as he it was someone else.
When the user is logged in, the limit will apply to the user regardless of the user session.
So if you allow for guest checkout, the limit mechanism is pretty much useless since the guests can just change their session to circumvent the limits.
You need to have a checkout only allowing login and registration to be able to properly enforce the limits.