Remove reference to spray attacks

[PieterKas]

Instead of referring to spray attacks, describe how an attacker might use the same QR or user code by sending it to the different recipients.