It might not be a bad idea to bypass the logic for sysadmins using IS_SRVROLEMEMBER().

E.g.

IF NOT IS_SRVROLEMEMBER ( 'sysadmin', ORIGINAL_LOGIN())

AND ... The check for num allowed in the table

Then rollback.

When you say you tested 'at the sql level' were you by chance using EXECUTE AS?