It's not that easy, you might be able to spawn/dupe loot, but its much less possible (I'm not going to say its impossible, but I wouldn't know) to hide their existence - after all, you yourself are telling the server that these items exist after you create/spawn themI mean, seriously, you're overthinking it again. If he's a good enough hacker to send death signals through the internet, then he can damn sure spawn a gun without the administrators seeing it.
edit: makes me wonder how the client-server-modell works with NerveGear, since it's using your brain input or something, is it even possible to run additional programs on it just like that? Is it connected to a PC just like a controller?