arp -a gives you a list of other connected devices on the network with their IP and mac address. For a paid-for hotspot this usually means devices that have paid for access and are active.

the ifconfig command changes your mac address into one of the chosen above; the AP thinks you're one of the earlier connected devices and gives you access to the internet.

The network I'm on has a bunch of people connected, but `arp -a` only prints one line. Is this the access point isolation the article refers to?

Also, why do they bother replaying the session, if changing the mac address is all that it takes?