The problem come from BPA, but it's normal. When a player try to join the server, BPA check with MojangAPI if this UUID exist. If it's true, it's a premium account, so BPA use Minecraft.net session like a classic online server. If the player is not the owner of this username because he is a cracked player, he receives the session error like any other online server. So this premium user is connected as a premium user with a normal UUID and his inventory is saved in a file which name is his UUID. If the UUID doesn't exist in Minecraft.net, this account can be use by cracked player. BPA doesn't use Minecraft.net session like offline servers and the player can join the server. So this cracked player use a cracked UUID with and without BPA.