You can't really return inventory / position to someone who logged out.
So, i guess You are doing it by removing inventory when someone logs in (the bad way) instead of doing it when someone logs out, and restoring it after they log in.
Also, i found something interesting while trying to find if anyone abused that before:
http://wiki.vg/How_to_Write_a_Client
At the very end, there's a list of client-side hacks with descriptions how they are implemented (That could be very useful for anti-cheat ).
So, i guess You are doing it by removing inventory when someone logs in (the bad way) instead of doing it when someone logs out, and restoring it after they log in.
Also, i found something interesting while trying to find if anyone abused that before:
http://wiki.vg/How_to_Write_a_Client
At the very end, there's a list of client-side hacks with descriptions how they are implemented (That could be very useful for anti-cheat ).