UTrustedPlayer has a good working knowledge about defending against this kind of thing.
You might also considering posting in the
XC_Engine thread on the UT99.org forum, or switching to XC_Engine to determine whether this offers you an extra layer of protection.
The join request string looks odd though, not that I've ever studied the format carefully. A typical example includes the previous map before the player name, but here it shows a port number and forward slash - perhaps that happens under other circumstances though.