1) I'm guessing this is how they handle people reconnecting after a disconnection. You terminate the old connection?
2) The bot replaces player 2, then submits a resignation. The server registers it as player 2 resigning.
Yeah, the seat is the problem. There are a LOT of security systems that depend on assuming the holder of a large random string, like a guid, is the proper holder of that string so it's not necessarily a bad thing for the match. They should have made the seat index random as well though they are probably now just checking credentials.
