Hi,
Currently the blocked request does hit PHP. We're about to fix this and add some serious love to blocking efficiency and performance, so please hang in there until the next release which will (I promise!!) really knock this out the park.
The blocked IP's eventually expire (they're stored in mysql) and are periodically removed.
Regards,
Mark.