That's true. But my service doesn't detect the retweet right away. So it has to stay retweeted for some (currently about 1 minute) period of time. I can tweak this parameter in future if I see that users misuse the service and undo retweets after receiving a code.