Back then the game was very easy to cheat in because even though the map was huge, the client kept all of the objects in memory along with their positions all the time - and it was very important in the game to stay hidden from other players and to hide your stashes of objects for later use. All of these was available in memory for grabs and there was no anticheat.
So there were people who wrote cheats that just grabbed the positions of those hidden stashes and bee-lined through all of them, robbing them.
The server logged the position of static objects (like stashes) on startup and logged the position of every player every few minutes. So I wrote a very simple application that parses that log and puts all of that information (position of stashes and players) on a human-readable map. The admin could then select a player and track his journey. It was very easy to spot people running in straight lines from stash to stash, it was obvious they were cheating and should be banned.
After that I added some heuristics that detected these behaviours automatically and gave hints to admin on who to check. There were more abuses possible in the game later on that I also detected.
For example, there was a "dupe bug" which allowed a player to duplicate a backpack full of useful items and give it to their friend. It involved two players staying in the same spot, dropping the backpack on the ground, trying to open it up by two people at the same time, one of them disconnecting, etc. The backpack was duped due to lag on the database on server side.
I modded the server files to log the information that a backpack was dropped or picked up (along with a list of items inside it in order they were arranged). Then I modified my log parser to look for two players being near each other, dropping and picking up the backpack, disconnecting and reconnecting constantly and detecting two backpacks with exactly the same list of items in the same order they were arranged it (which was very unprobable to happen out of itself) - detecting this gave a hint to the admin to check these people out as possible dupers.