I'm working on a quick little program that can detect this sort of mischief. It will basically monitor for join packets to clients already in the server. When one of those packets is detected, it will notify the server and display the IP address of the offender. It will also save a log to disk in a special binary format (to prevent falsely blaming people). Unfortunately I won't be able to make a program to block the packets, because the capture driver I use cannot do that. But at least we might get some idea of who is actually doing this and if it is just one person or multiple people.

This should be done very soon because I have most of the code already written in another program. I think it is badly needed too, because multiple people are being blamed without a whole lot of proof or evidence.