When I cancel the click in a chest gui, it is preventing the click from happening, but not the swapping to the offhand. The result of this is that players can simply press 'F' on an item in the gui (that's not supposed to be obtainable) to get it. 

You would think that I made a mistake in my code, but the cancelling is working in 1.14.4, and no items can be stolen by swapping it to a player's offhand.

I hope that this really is an issue in Spigot and that I'm not wasting your time.

 
Update: it seems like this is a client-side issue somehow. The items are not actually getting duped it seems.