People able to spawn blocked models on my server.

The title says it all, people are coming onto my server and spawning the mk-82 bomb and other blacklisted props.
Are people exploiting FPP?
My server does allow clients to run lua scripts so are they using a script to un-blacklist it? (sorry if that isn't possible and I look like a retard)
Thanks in advance.

Edit: last night I tried to post by my Internet died so sorry for (maybe) double posting.

You tell me you master hacker how u know my browser and isp??

M8 go back to yer aerial pingpong yah banana bender aint nobody want yah stupid bloke, man yah you must be bloddy fuckin gay to walk round these parts.