For the double spend to occur, you would need access to the seed ( private key) which the victims had and are trying to outrun the attacker in the case you were describing.
So it works a bit like replace-by-fee on bitcoin? There is no mining on IOTA so what is the possible time frame? do you have more detailed technical information how this works? Thanks
It is so you do not need to know the private key. So that you can forge fraudulent transactions without knowing the private key.