So the malicious user lies about their location (and other "basic info") - trivial if you're at the point of having users enter their seating location, only slightly more difficult if you also use GPS to verify it. Yes, they have to be in the theater, but if you get bored during a movie and feel like messing with people, then there's nothing stopping them.