Currently this assumes words are separated by spaces. If this is not the case, or if an earlier attack removes a space, several words may be treated as a single word (such as send.me.money).
One way around this is explicitly to keep track of word indices in the original string (assume here that they are separated by whitespace), and then modify these as attacks modify words/text.