Is this the same person who owns the steemitmarket account and was offering to sell votes a few months back? I had a chat with them on Facebook, and I don't consider them ethical actors. I appreciate them stress testing things, but that can be done on test chains with input from the dev team. To me, hacking "for the money" isn't ethical. There are always going to be potential exploits of shared resources, and no system is perfect. It's always a balance between protecting the system and keeping it useful to ethical actors. I hope there's an easy fix here, but I fear there is not.
Thanks for keeping us informed.