Thanks for bringing this to our attention. I'll have to run this by Megiddo since he's a little more familiar with this than me, but unfortunately I don't think there's anything we can do to prevent this directly, since I think when any user presses this button (hopefully an admin), it runs a command via their console. I don't think there is a way to detect
where the command was run.
However, (again, I'll have to run this by Megiddo
) it may be possible to have ULX check the map for lua_run entities, and if possible, scan them for ULX commands. I think this sounds feasible and would be fairly easy to implement.
EDIT: If you'd like to respond to that thread for me, that would be helpful. Unless I'm mistaken, we should be able to prevent things like this in the future for ULX.