I'm a retard, I forgot to switch to random.org after testing:
//get a random number for next game:
/*$ch = curl_init('http://www.random.org/integers/?num=1&min=1&max=8&col=1&base=10&format=plain&rnd=new');
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$randnum = trim(curl_exec($ch));*/
$randnum=rand(1,8); //temp
But that still doesn't explain to me how they could know rand() was going to return three 1's in a row.
I might be being dumb here (I'm not logged on and don't have anything deposited,) but the MD5 on the page doesn't change when you refresh the page. That suggests that the same combination is coming up every time.