I believe if your RESTlet is using TBA and the web services and REST concurrency governance is enabled in your account, the user is allowed to send concurrent requests even if that checkbox is enabled