Yeah, it seems like it relies on some external tool to make it appear like the language came from another gamer tag. That seems like the root cause to me - how is it possible to emit messages under an account you're not logged into?

In Minecraft Java everything is tied to a UUID that's unique to each account, so it shouldn't be possible to do a simple spoof of a nickname.