He realized that the discovery server was just handing out another hostname, so even though he couldn't spoof the discovery server since he knew the hostname it was going to provide he put that in his local DNS and point it at his server. Since the RTMP server was on a different domain the best solution would be to make a wildcard for that domain that points at his server, that way it won't break if Twitch shuts down or starts up a new server in his area.

As someone who works with RTMP/S a lot, I suspect the Twitch endpoint is accepting RTMP streams even if it specifies or usually expects RTMPS - I find very often that servers will accept both.