Not 100%. In Threema, a malicious server could replay an old add-this-user message after that user has been removed from the group to re-add it to the group. Bu

Not 100%. In Threema, a malicious server could replay an old add-this-user message after that user has been removed from the group to re-add it to the group. But it could never add new users (since add messages are encrypted by the admin). Also, the server can't tell group control messages from regular text messages, making this even harder. Replay protection has been added in the meantime.