Maybe it filters out the movement data which the client sends to the server and manipulates it.
Or is the whole movement calculate on the server?