One day a colleague of mine found he could use Cheat Engine to scan the memory of the Flash application and change some values in order to get an upper hand and win PvP matches. Turns out the devs neither did nor verified the PvP battles server-side. It was all done client-side and after the battle the client was sending the server info about who won. A fix would require a complete rewrite of the game logic.
We had several weeks of "fun" beating the shit of everyone in our game world. The devs attempted to make some fixes - make it harder to load the flash file, obfuscated (Base64-encoded) the JSON data sent to the client - this was a funny one, since it was irrelevant. In the end, as the author here says, it was no longer fun, so eventually we stopped playing.