It seems that truce cooldown is enforced by the Evony client, and not at the API level. So, if someone is using a third-party client, like, oh say, a b0t, then it can simply make the API call to activate the truce without regard to truce cooldown status.

On the one hand, you could say this isn't really a bug, because this was never intended to be a public API. On the other hand, this behavior should be very easy to profile and identify. So, it would seem to be yet another example of Evony not making even token efforts to enforce the ToS.