You can prevent this by evaluating the client-movement
on the server, and snapping back the client
(or making him inactive)
This is quite complex though, to get it properly working.
(and would require to let the client send
all data that was used to change and calculate the
movement, the server reuses this to determine
if it was a valid action)


You could also do a simple function to
see if a client sends positions, that would
in reality intersect with the walls/floors.

In an indy game, a client-kick + ip ban should be enough