So how exactly does hit validation work? Does it wait for the killer's client to say that they got a hit, and then check to measure the distance between the killer and the survivor when they receive that message? Isn't that going to be a little weak, since a killer can just swing and then get close to the survivor?

Or, does the server keep a timer, and check to see what positions registered at the specific point in time at which the client says they got a hit?