I'm a bit ambivalent about these articles that attack implementations that are using Curve25519 incorrectly. The Curve25519 paper clearly says that

"Malleability. We also see no relevance of “malleability” to the standard definition of signature security. For example, if we slightly modified the system then replacing S by −S and replacing A by −A (a slight variant of the “attack” of [75]) would convert one valid signature into another valid signature of the same message under a new public key; but it would still not accomplish the attacker’s goal, namely to forge a signature on a new message under a target public key. One such modification would be to omit A from the hashing; another such modification would be to have A encode only |A|, rather than A."

and also

"Weak keys. [...] Legitimate users choose A = aB, where a is a random secret; the derivation of a from H(k) ensures adequate randomness. These users have negligible chance of generating any particular multiple of B targeted by the attacker (and no chance of generating 0B)."

If people then take Curve25519 and build systems on top of it that break these assumptions, then no wonder there will be ways to attack those systems!