I have good reason to believe it's SINISTER (the real one), duping coins. I don't have any hard proof other than my word, but just a heads up:
I saw Gnight crashing the server by joining rapidly earlier, and SINISTER getting on occasionally. I assume SINISTER is double logging as, and duping coins using the join trick to crash the server.
After he rapidly joined with Gnight, he would get on SINISTER again and repeat the process. However, one time the name SINISTER was the one joining, rather than the normal Gnight. I think he probably forgot to change his name back after he had double logged. Obviously this is just my word, and I don't believe any of you to take it seriously, but it's all I can give you for now.
Particle: Couldn't you code in something that automatically locks down the server (with a password) for a certain amount of time, after it detects someone joing x number of times in x seconds, with the same IP? I've seen this done on TAC.
Also, he is probably using :
http://www.linneberg.com/dupecoins.html