Yes, this does allows for other users' to spoof this data.

Literally all this function does is simply add user id's to our prediction server... worst case, someone could flood our engine with millions of unused user accounts.

Ideally i was hoping that we'd be able to read the user's session from the request so we didn't have to pass along the user id but the sessions information wasn't available in the back end when we were setting this up.  Hopefully this can be looked at some more and we can do a lot more with the session variables