Well, he's 13... Sorry, I was really frustrated that this was even a thing that existed.
Apparently there are hacked clients you can get. It's a modified version of Minecraft itself. So there's not even any duping of the server. It's all client side. Apparently there are people out there that really hate Minecraft as a game, but really want to play it anyway
There's no way to actually block it with a mod, but there are tools out there that detect what looks like cheating (moving too fast, flying, finding too many diamonds at once, etc...) and kicks or bans anyone doing it.
There's also a permissions mod that I've wanted anyway. Anyone can log in and look around, but we have to whitelist them for them to be able to manipulate anything.
We did have a long talk about how shitty that is to anyone else playing on the server and about following the rules. I also pointed out that there are tons of creative servers out there if that's how he wants to play. I think I got through to him. The good news is that it breaks his character file on the server and crashes everything. So until it's updated, he can't use it anyway.