Well when I said that of BoB I'm assuming that someone that runs the site has access to all the private keys of all the address and the database that states which address belongs to which user; and that such person is willing to do all the verification and sign a message with the involved address stating it belongs to person x and that it should be refunded to address z. Other than lack of willingness I don't see why it couldn't be done.
http://trilema.com/category/rota/But good call, I hear that was the reference.