HTTP URL Server side plugin bypassed!

Hi,

I am using a HTTP URL server side plugin to target a controlled list of our client for a Beta release. The support team got a call from one of the non targeted user that they received the update :confused:. The plugin itself is straightforward no brainer that uses the profile data and matches it against a Sql table to determine if a specific client should get the update or not.
Can anyone shed some light what can be causing this behavior.

Thank you for your help.