It's not as simple as you think.
Forge uses a lot of Java backend/internal stuff and most, if not all, of it has changed between Java versions 8 and 9/10.
All of that has to be rewritten to work in Java 9+
It's being worked on though, Forge 1.13 will run on Java 9+
Are you using the standard Mojang launcher?
Have you customized any of your launcher profiles?
Where are you putting your mods? Please give the full path to your mods folder.
You have Java 10 installed and your computer is using that rather than Java 8.
To launch with Java 8 instead of 10 you need to use the full path of the Java 8 java.exe, rather than just using the command java
Some people refuse to give up their favorite mods from back in the day, they would rather live in the past and demand that mods be backported rather than find new favorite mods in modern versions
Some modders are in that camp and others fall to peer pressure from that camp.
There are also those who hated the combat update with a passion and refuse to accept the change.
You have decided that you are fine with any and all signals, whether malicious or benign, doing whatever they want on/to your computer as long as your friends can access your server.
Re-enable your firewall.
Port forwarding is not the same as allowing a program through your firewall, you should NOT take your firewall down completely for any reason.
Port forwarding is telling your router that anything coming in on *this* port goes to *this* device on the local network.
Are you using Hamachi or do you have your router port-forwarded?
Do you have your firewall set to allow Java through?
Do you have an antivirus that might be considered to be overzealous?
Yes all of this is happening inside vanilla code.
Is this only happening to one user?
Are you using any mods that don't use Forge? (Server or Client)
Are you using a hosting company or running on your own hardware?
I don't understand how that's possible unless a mod is doing something funky and re-triggering some of the login code or your user isn't reporting everything
The error shows up when a player logs in with a UUID that's already logged in.
I suppose this could happen if the player loses connection and tries to reconnect before the server is even aware they disconnected.