What code version you are running on the switch? In some of the older code
versions, the switch will learn the IP Phone MAC address both in data VLAN
as well as voice VLAN. When the IP Phone boots up, it will not know anything
about the Voice VLAN. Hence, it just comes up as a regular host and sends
untagged packets towards the switch. Switch will receive it in the native
VLAN and then handles it accordingly. The IP Phone will get an IP in the
data VLAN range first and then contacts the TFTP server for IP Phone
configuration. Once it downloads the configuration and realizes the voice
VLAN, it disassociates itself from the data VLAN and sends a new DHCP
request (tagged) on the voice VLAN. In the latest code (fixed) the switch
will remove the IP Phone MAC address association from the Data VLAN.
However, in the older code, the switch will not delete the MAC address from
the Data VLAN. That is the reason, you will see 3 MAC addresses (2 for IP
Phone and one for the PC). So, it is OK to set the limit to 3 as long as the
duplicate MAC is of the IP Phone alone.
Hope this helps.