something in .info's protocol is allowing people to broadcast spent inputs as long as they are unconfirmed.
You can do that with almost any wallet, and the ones you can't do that with you can do it by removing some code. The only solution is to wait for confirmations. Unconfirmed transactions can be double spent, the whole point of confirmations/mining is to prevent double spending. If you accept unconfirmed transactions then you're probably going to get scammed eventually. Some businesses such as bitpay have mitigations that make it somewhat harder to double spend but it is still possible to do so.