This problem has been known for a long time, that it is possible to receive fee to any specified address when recovering a wallet via recovery tool.
I wonder why the developers do not solve this problem? It was written about it on reddit and @darthcoin wrote about it in one of his articles, but this "vulnerability" can still be exploited.
I think it's just spiteful attitude and unwillingness to switch to full use of LN instead of atomic swap.