First of all, I want to ask:
Why aren't tools like these bound by permissions? What actual purpose does a Grotto Spawner serve and why aren't they for OP only on a server?
Our server is whitelisted now, and I have loaded a backup I made just last night after his first attempt-- which means he will likely go after other servers with this. So what can be done? Is there no way to disable this fun novelty item to prevent this from happening?