Does SQL Server 2008R2 Express actually enforce the memory and CPU limit?
SQL Server Express does enforce the limits, but the limits are not what you expect:


CPU: SQL Express enforces one socket, not one CPU. Multi-core and hyper-threaded machines will leverage multiple cores on one socket and SQL Express will use 2 or 4 cores on that socket. See Maximum Number of Processors Supported by the Editions of SQL Server:



  
    SQL Server supports the specified number of processor sockets multiplied by the number of logical CPUs in each socket. For example, the following is considered a single processor for purposes of this table:
    
    
    A single-core, hyper-threaded processor with 2 logical CPUs per socket.
    A dual-core processor with 2 logical CPUs.
    A quad-core processor with 4 logical CPUs.
    
  



Memory: Express restricts the max size of the buffer pool to only 1GB. The buffer pool accounts only for some of the overall process memory.


See Thread and Task Architecture and Memory Management Architecture