I was away for a few hours, so I made a simple game and password, hid offline, expecting it to be up when I got home. I arrive and log in to see that two people joined my game, stole my anni and left. Can I post their tag numbers here to blacklist them?

This means they were actively guessing both game names and passwords, as I had both enabled, was hiding offline, and had friendslist joining off. I have the chat logs showing what happened.

Or is this just a lesson, and I move on and do better?

It was probly someone on your friends list that joined your game.

Nope, checked their tag, wasn't anyone I knew. Plus had friends list joining off.

I'm also not friends with anyone who would do that.

With new systems comes new cheating methods. Probably someone made a program that can see game names and passwords.

don't use legion//1

This is a lesson and nothing more.
1. You have no way of confirming that the two users even use jsp.
2. Jsp wasn’t involved in this whatsoever so there is nothing that Jsp could or would do.

Sucks it happened but stop using simple game/passes.

There are no friends on d2