There seems to be a bug that is caused if a plugin clears a player's inventory when they join the server.

If a player logs out holding a weapon (e.g. diamond sword), when the log back in they attack with the damage of that weapon even though they don't have it any more. This extra damage is permanent. The only way to undo it is to delete the player's file from the world/playerdata folder.

I have attached a screenshot of the part of the player's data file that I think may be related to the bug, as well as a test plugin that simply clears a players inventory when they join and broadcasts any damage a player deals to any entity. The plugin jar is attached and here's the source: https://gist.github.com/St3venAU/4747917e1b0bba5afacc