I put a single IP address into the ban list and the app kept redirecting me to the ban page. Since my IP was being "banned" without being on the list, I assume every visitor to the site was also being redirected to the ban page. I wasn't even able to get into the admin page to disable the plugin. Fortunately, the site is part of a multisite installation, so I was able to use my network administration access to edit the plugin source code and force it to allow all IPs long enough for me to disable and remove the plugin.
At the very least, the plugin should not ban logged-in administrators under any circumstances.