alt Hacker NewsOK, I haven't looked at the exact sequencing here. But generally, once the action goes back to the anti-abuse service for checking the user can't be allowed to change what they're submitting. The view the anti-abuse system saw has to match what the app server sees.
Still incorrect because the user in this case is being prohibited from submitting anything at all.