whitelist bypassing?

I have a rather big server, where we are using whitelist if a lot of Mojang servers are offline.
For example atm, where minecraft.net, authsession and login.minecraft.net are offline, we put this on. Now i see, some players are logging in anyway while these servers are offline, can these accounts be legal?

 

are you running with online-mode set to true or false?

 

Was false during whitelist, but normally true.

 

Then both legal and non-legal accounts can log in as long as they match the whitelist. Hell, I could make fake my name to your minecraft name and log in as YOU while it is set to false...

This is why no support is given for servers running in offline mode under any circumstances.

 

Thanks for clearing that up