The damage is server sided, the bullets hit aren't (<- 2nd reason why the "no serverside debuff" dc sometimes). If the client doesn't tell the server that the player has been hit, the server trust the client. Well, after a couple of hits it disconnect, ok...