exploiting keccak for random number generation?

Question

Whenever a ticket will be purchased, a random number will be generated

function _mightWin()
        internal
    {
        address _player = msg.sender;        // players address
        uint256 _tickets = tickets_.length;  // amount of total tickets so far

        // generate random number
        uint256 _ticket = uint256(keccak256(abi.encodePacked(block.timestamp, block.difficulty, _player, _tickets))) % 289;

        // ticket has hit the winning number
        if (_ticket == 42) {
            hasWon = true;
        }
    }

The contract allows players to only buy 1 ticket per minute. Some genius has made a contract to play this game, where the contract buys exactly 4 tickets from 4 different addresses and wins (in a single transaction).

How is this possible? When generating the random number, timestamp and difficulty are always the same number, but the players address and the amount of tickets is different.