Players can tick themselves arbitrarily

By sending a PacketPlayInFlying to the server, a player can tick themselves. The server trusts that the player is ticking correctly, and therefore processes collisions as well as other player-specific updates every time it receives a packet. This allows for a very wide range of exploits.

You can see the line of code here that is called any time a player sends a PacketPlayInFlying:
https://github.com/Bukkit/mc-dev/blob/master/net/minecraft/server/PlayerConnection.java#L183

The solution is to rework the way in which the server ticks players to be less trusting.

I worked with the CB team (back when they existed) to resolve this but we determined that it wasn't possible to do without changing the Minecraft protocol.