It seems to me like their is a mole in your camp and assigning blame should start internally. I expect you have already found this person, you can rule out anyone who does not have the skill to create a certain loophole that would allow a client to access a server side action. This action whatever it is was assigned a…