login-protocol/scoreboard security issue

This is a 'private' version of bug

MC-56479

According to Searge, this is a security issue, so I wanted to expand more details in a PRIVATE bug that would not be duplicated or made public to public bug listings.

This unlisted video explains the problem:

https://www.youtube.com/watch?v=_csEt5hs9Do

Briefly, an attacker can mess with their network connection in a way that busts the scoreboard (until e.g. scoreboard.dat is deleted), and this attack can appear to be just innocuous network/ISP issues. In general, I worry that there may be other latent attacks that exploit this weakness of the server login protocol.