It is possible if the botnet is large enough, for example, 1000 bots, each bots make 10 connections, that will be 10,000 connections, and it still not reach the threshold to ban a IP yet.
If it happen again, you should check your netstat output see if it is true.
What can you do if it is true...