ITs a really old bug, there already is fixes for it, the onyl one I know of is for etpro, its all ive used and its a .lua fix.
But I think there is a cvar you can set, that doesnt allow more then 1 player from the same IP connect.
This will fix it.
The .lua fix is called fakeplimit.lua I believe, and the exploit is something called q3 fake player bug or something.
Same bug for most q3 based games.