[Kevin_b_er]

Sorry but something else is definitely wrong.

sm_cvar is restricted those with the CVAR changing permission or, in theory, RCON permission since the console has root-level permission.

Check the logs to see what it says about them changing stuff. Additionally check "sm_who" while they are online to make sure that's the flags they are supposed to have.