The fact that for the most part the server believes the client for
positioning data, especially when lag is induced, to avoid the annoying
rubberbanding effect you sometimes see with mobs, and got to experience
first hand as a player in, for example Asherons Call 1.

There are supposedly checks in place to detect various move/warp
hacks... but I honestly don't know. We all occasionally hear reports
about vender profitable tradeskill combines that are exploited by macro-
bots that utilize warp hacks. ... I don't know what to say to that.

Detecting speed hacks should be possible looking at known positions and
elapsed time. That should cover anti-summon, speed hacks, and long
distance warping. Anti summon is particularly easy to check for.

Vertical warps (up walls) should also be possible but it would require
different checks, and may be exploitable if you do it slowly enough
depending on how jump, levitate (and levitate "bobbing") are
implemented.

Going through Door warps, however would be much harder with position
checks because now the code would have to establish not only distance
travelled, but intervening objects and their state. This could be fairly
expensive processor-wise, especially since it would only be relevant
very very infrequently. You'd have to check just the moment it was done,
while most movement cheats can reasonably be detected by random
sampling.

(And once a character is flagged as suspicious, perhaps not so random

It would however be possible if you divided the zone into subzones and
checked the objects last-opened timestamp state whenever a character's
position was in a different subzone than the previous recording.
Inducing lag it might be possible to slip by a door that was just
recently opened, but that's hardly a general purpose hack. It also means
that if you ever try just a little too late, and fail the check, your
account could be flagged for increased scrutiny.

This method has issues where subzones are accesed through more than one
object or which have an object blocked entrance and a free entrance
(e.g. a room that you can either open with a key... or float through the
window with levitate if you jump off a nearby building) would all be
issues that would need to be overcome. Fortunately i think combining a
postion check along with an object check should be able to catch most,
if not all, cases.

Actually I'm not so convinced. Its entirely possible that the isBanker
flag for npcs copied down to the client, and its possible that if the
client sends the "banker-clicked, please open bankwindow and send
inventory down from the server" event back to the server that the server
trusts the client and doesn't validate the target. Its certainly not a
dangerous exploit... you can't dupe items or get xp without risk etc...
so its likely not a highly scrutinized bit of code.

I'm not saying I buy that its real, but its not as far fetched as all
that either.

The good news is that if such a hack exists its pretty trivial to fix:
Validate the target as a banker serverside. If its real expect it to be
fixed in the next patch.