I don't have an answer but I would also like to know how to kick them.
I'm not sure if this helps or not, but I had a similar post here.
What you could do on your clients is add the meta data (if your using a version that has that support) to your sessions so you can uniquely identify which connections you expect. Then you can list all the connections using JMSServerControl.listRemoteAddresses. Then you can use JMSServerControl.listConnectionsAsJSON to see which connections are valid (using the meta data client id) and isolate the invalid connection.
Hopefully that helps.