After all these times... it was a netprop.
A netprop.
I thought they did magic trickery on the client so it'd be ridiculously hard to fix on the server... that would've been the best solution they could've come up with.
But nope, turns out they were lazy and just added only one extra step for fake wearables.
...
I wonder if people would receive warnings or bans or get their posts deleted if they talk about
m_bValidatedAttachedEntity on other posts of the site?