Was he on a current svn server or just a 2.3 one? A speedhack has been already patched in svn, and will be fixed in 2.4 which should come out next month. Try using a newer engine on that server and check if he can still speedhack.
A demo is not useful, by the way - the only useful thing would be a network packet dump (like tcpdump does).
1. Open Notepad
2. Paste: ÿþMSMSMS
3. Save
4. Open the file in Notepad again
You can vary the number of "MS", so you can clearly see it's MS which is causing it.