OR… since we know there's been top level domain server misdirection by the two TLD servers under Chinese control…
It's not a huge stretch to imagine that the code for these problematic image boards is well known, back engineered, and injection/modification techniques and exploits have been developed. The only thing missing is the trip code, which with a double hash, would be too expensive and time consuming to resolve, so you get what we've got.
Also, if Jim or whomever is Global Admin, is the target of a sophisticated intelligence agency, then key loggers and auto screen cappers would sniff the admin pw and give it to the clowns for backdoor ops like this.
Secretly stealing secrets. It's the name of the game.
Weaponizing information.
It's not legit without the trip. Period.