So...when one can build their own blocks, they can also set the timestamp in those blocks. When one can set the timestamp, we can have two blocks with a real-world 3 hours of time between them, but a 38 second reported block time. And when the wallet's block time testing isn't working as it should, blocks that are earlier than the most recent in the chain can be accepted as valid. And...here's the important point to all of this: The diff algo uses the encoded block time to adjust the difficulty - it uses the reported block times, not the real-world times. That's why we can have widely spaced blocks - that should result in our difficulty rapidly decreasing - yet find our difficulty rising. And while our algo is designed to rise rapidly when hash power increases, it really jumps when someone tosses in blocks with timestamps that go 'back in time.'
It is not evil intent, just plain drift in computer timer. But CAT can be easy forked for double spend if not go to PoW+PoS system.
I hear you about computer time, but we've ruled that out in this case. By flooding the network with small transactions, it's easy to spot the legit miners that are moving network transactions and the selfish miners that are making blocks to take the block fee. That also made it easier to show that the guy making empty blocks is also the one submitting blocks with earlier timestamps. As reported earlier, we found a flaw in the code that went back to the BTC/LTC codebase and we've fixed it. Once the code activates on Sep 1st, we won't accept these blocks.
The ability to 51% and double spend is the same as any other POW coin. We're watching for it but haven't seen attempts to double spend so far. As we continue to grow, the chances of that decrease a great deal.
We're still looking at different systems. We've ruled out pure-POS as it's even easier for an attacker to take over a POS system than a POW coin. We'll see how things look after the new code activates and go from there.