If the same host keeps setting off clone alerts, then services will send a message saying it is stopping alerts concerning that address. It will then stop sending alerts for a number of seconds equal to the throttle setting. This is designed to prevent network operators from being flooded with redundant information.
/as services set throttle 30
A good throttle should probable be between 15 and 45. That gives the network operators a chance to deal with the clones, but allows for new warnings if necessary.