Glad this is getting some attention from ED mods, on the Russian side of the forum things seem to be ignored - unfortunately.
From what has been discussed so far on the Russian side:
Code injection via an unchecked LUA file
Mission file is edited/exploited on the client side thus the spawning over airbases and so on
We have seen it before, on numerous occaisions when client aircraft spawns in the air while the mission specifically states to spawn on the ground. This is due to some sort of corruption when the client joins the server and retrieves the mission file. Well this guy took it further and is basically able to edit the mission to his liking, and the server has no tools to protect against it.
So, it is my belief that introducing an ability to integrity check the mission file on client's end will resolve a lot of the issues presented. At this time it is impossible as the mission file is stamped with the local (client's) time.
A-10C and BS2 network code and by extension FC3 will not completely resolve the problem. The only thing I believe FC3 will help with will be UCID spoofing which is rampant right now.