This is why I don't stress too much about validating game state in server scripts. It lets the kids cheat clientside if they can figure out how to rewrite and load the Lua scripts.