There´s a big chance that the first post is not even close to being a hacking, I mean, you think it is because he rejoined and the server crashed? Specially being at Cyan´s server (who´s not much of a smart one).
They just used Clearbans, being an admin on the server or the host itself using it, anyone could´ve rejoined, and servers crash everytime, usually with Signal Handler. Also, the time he took to take the server up was because he wasn´t in a hurry to play, or he added wads.
Now I´ve seen actual hacking, such as players being forced to say things (I´ve checked the console, and it wasn´t a type trick), people skipping the administration password without being verified by the host from servers they´re not familiar with. 2 identical IPs (Listserving), and sudden server closings.