I'm aware of things like that and in my case it's not a problem because it's a VIP plugin which is used by very trusted people only and on my server only
They don't even know things like that to be able to do those tricks
But good note anyway.
P.S.
I used "sm_play @all" way though.