we tried hat spam exploit. it was basically working really well. and its already patched.
It is most definitely a security issue in one of your remotes. Unless your friend has been heavily using free models and installing malicious plugins, it is a security issue on his side.
Please double check all remotes and see if one of them adds a accessory to the character. If it does, add a check ON THE SERVER if the character has >10 accessories already, not on the client.
He didnāt mentioned where hats spawn, he said into avatarās head.