After login there are two sets of offer updates, I suspect the first is from the server and the second is from the ge server - this also flags ge server trade updates as on login. To do this we assume it always happens in the first few ticks after the login burst.