And noone came to think that it might be a tool that everyone has and is injected with troyan or wyrm. This is NOT AN SQL INJECTION because the gm would have spoted that already and fixed it.
Edit: If the hacker had access to the DB why would he need to enter the game to hack them. He could just delete them all.