It was sponsor document which harvested session tokens. Could've easily been fixed if IP difference was flagged or drastic changes to account put behind another

It was sponsor document which harvested session tokens. Could've easily been fixed if IP difference was flagged or drastic changes to account put behind another login