Users are abusing this method to access the wifi internet connection without using a voucher. This is an absurd flaw of omada controller. By changing the device privacy mac address to random mac address. 
Check this video: https://encr.pw/JNSDN
as you can see the privacy option is set to "device mac address" which is the default setting for it, by changing it to random mac address thats the time they can access to the internet. Need to this fix asap.