Actually, the first part of the rule is the problem:
"\.[a-z][a-z0-9]{2,3}" is read as any extension that starts with 'a to z'
followed by 2 or 3 characters of 'a to z' or '0 to 9', which means gbc1 was
matched against this.
I personally disabled this rule as most "bad" extensions get blocked
anyways.
Cheers,
-Joshua