The packet ID filter is not enough, since it still could be a spoofed response. Smack may has to verify the from attribute or take other countermeasures.

See also:

• http://mail.jabber.org/pipermail/jdev/2014-January/089824.html

• https://mail.jabber.org/pipermail/jdev/2014-March/089892.html