Well, garry decided to crack down on commands executed from lua again. Known blocks so far are "exec", "sv_cheats", "bind", and "lua_run". I don't see any other choice but to put the hexxer back in, otherwise people can't target players with these words in their name. I have to laugh though, these blocks make it so you can't select some models, like "binder".
Should we also reinstate the lua module that allowed us to run any command on the server? Then we can clean our hands of garry's mess and never worry about it again.