My guess is that there's a bridge between the NIC and the VM though which they're imposing the limits.

Could be OVS with DPDK support, for example.