I imagine it’s due to time stamps and sequence numbers. However, those can be replayed as well. 

The attacker can't create new sequence numbers or time stamps without being detected if the integrity of every message is maintained. This can be obtained by using HMAC verification of an authentication tag over the message. The attacker doesn't have the symmetric HMAC key if it was sent over an encrypted tunnel between the victim and server.

Is there more to it than this? Or is this really the basic idea?