You are partially correct. The guid was "stolen" when it was used by someone other than Ghost Shell. The collection of GUIDs by a server operator is simple to accomplish. If such a system were set up, it would continue to collect them all as long as it ran. If Polly did collect a GUID, then Polly has such a system in place and the danger continues. If Polly did use Ghost Shells GUID to damage a competing server then any visitor must accept that Polly may do the same to them. Collection of Guids is simple by the way.
A server operator abusing the security system that all of the servers run on (regardless of what anyone thinks of it) is a much more serious thing than a server operator coding in their own changes without releasing them, though I would look on neither of them as a good thing.
I was never convinced that Polly did this, as I have never seen actual evidence. You f0rqu3 are certainly changing my mind.