Where's the vendor Xap in this?
Were they not obligated to deliver a application system resistant to obvious forms of fraud and abuse? I know they're primarily an Education software vendor but this seems especially poor.
The current system, now called “OpenCCCApply”, was mostly developed by a team from Unicon (https://www.unicon.net/), along with folks within the CCCTechCenter team of my memory /understanding is correct (I’m not sure if it’s managed jointly though, or if only a CCCTechCenter team mostly manages it now though since I never heard those types of details).
A redesign/modernization effort however sounds…expensive.