The following .htaccess file gives the user three chances

AuthName "KeepEmOut Processing Centre MyDesk"
AuthType Basic
AuthUserFile /usr/local/apache/share/cgi-bin/.htpasswd
AuthGroupFile /usr/local/apache/share/cgi-bin/.htgroup
<LIMIT GET POST>
require group MYgroup
</LIMIT>
[download]

Some additional directives from the conf file are:

<Directory />
Options None
AllowOverride None
</Directory>
[download]

and

<Directory /usr/local/apache/share/htdocs>
Options Indexes FollowSymLinks
AllowOverride All
order allow,deny
allow from all
</Directory>
[download]

My point is merely that three-strikes-and-you're-out appears to be the default behaviour for an Apache 1.3 web server. One must do something special to get the behavior you describe.

Is it possible that the Apache::AccessCheck module is causing this problem? If so I wonder whether judicious use of Perl's eval function could hit the spot.