you can also join passworded servers that you want to spy on that your friend gave you the password too :D
Hmm. Is that the %int in my version? The password? Because I haven't been able to check that. As I said, I've had someone else host and check stuff for me, and we didn't try passwords since you know they block this anyway.
Well if all they can do is listen to the chat (and not actually harm the server etc.) then you could make your own servercmdMessageSent() function.
Well, it'd be more like modifying the messageAll directly, but I'd rather not mess with that. People who mess with it break my clientside scripts.

Besides that, the extent of what they can do isn't fully known. You just need to study up on what connections interact with.