it really sucks that you guys lost your server first, which it sounds like you rightfully deserve, however, wouldn't this be a situation that you are responsible for rather than blizz?
No, it wouldn't. Being invited to a group isn't a free invitation to be able to raid on someone's raid id. You're all missing the point of how this happened. They completed the raid with no one from the original group in the instance due to a deceitful summon request. There are other scenarios where this would apply, and none of them justify the actions of the other guild.
How about this for an example? You're flying around Durotar on a Vial of the Sands mount, and someone requests group just to fly on your mount for a second. You accept group to be a cool person, while someone unknowingly runs into DS and snatches your raid ID so they can bypass a boss and take your weeks worth of work. (I understand they didn't lose their lockout, but it allowed someone else to do something they couldn't have done otherwise.)
What if you're friends with someone in that guild and they ask you to do some arenas or BG's something of that nature? Then they run into DS to copy your raid id. That is not how the mechanic is meant to work. If anything this is a sign that the lockout system needs attention. Something like a dialog that allows someone to be extended to your lockout when they zone in, would completely stop this from happening.
Is that acceptable? Should a player have to constantly be thinking about all possible motives from a seemingly harmless request? The answer is no.
If Blizzard doesn't do something about this, when they go on and on about supporting fair competitive play, then I will definitely think less of them as a company. World firsts aren't the only things that matter to competitive players, server firsts are also very much desired.
The fact of the matter is, even though the world first achievement only requires you to kill Madness, the instance IS gated in that you have to kill spine first. Someone was deceived with a copied name and an innocent request in order to get a raid lockout that they could not otherwise achieve. That is the clear definition of cheating, and I sincerely hope that all the accounts that were involved get actioned. The account that impersonated the name of the player in the guild, should realistically be perma banned as well as that directly violates the ToS.