Anyway, I believe that I've fixed the exploit, thanks to some code Powerlord wrote (but didn't activate).
What this code does is intercept whenever a player is trying to change the team, and 99% of the time deny the switch. For example, if you're trying to switch to the boss team, nothing would happen. Note that this doesn't affect plugins that use ChangeClientTeam() (since the method catches the "jointeam" command).
Some more examples:
FF2 switches someone to the boss team-Switch succeeds.
You try to join spectator-Not allowed, unless your server has mp_allowspectators enabled.
You try to join a different team-Not allowed, period.
Threaded Mode