You bring up an excellent point about simply replaying the same message. I'm curious what mechanisms are in place to prevent that.

And yes, the exchange was B -> A which gave automatic authorization for an A -> B transmission, which I do agree is a bit presumptuous on their part.