SIP device with a lot of BLFs can trigger a responsive firewall block

Customer was having issues where legitimate phone registrations thru the responsive firewall were being flagged as abuser by responsive and getting blocked. Thru experimentation, they determined that a single device with a lot of BLF subscriptions might be enough to trigger the block. The sequence of steps goes like this:

device Sends SIP REGISTER
Asterisk allows registration
firewall daemon is not yet aware of the registration due to the lag
device sends flood of SUBSCRIBE packets
iptables senses a lot of SIP packets from this device which is not yet whitelisted in responsive and blocks the IP

from this point on, the responsive block stays in place