There are several ways to do that.
What exactly he did depends on which mods etc. you have on your server and which access rights he has.
The best way to find that out is to get him telling you what he did.
well, after a bit of annoyance, he gave in, he said something about disguising commands as packets.
We have Buildcraft, Iron tanks(for BC), galacticraft and it sforge 1.12.2. he has no access rights(not opped or anything at all). so yeah