We know what's wrong. The problem is the fact that people in Creative mode can spawn whatever they'd like with whatever NBT tags they'd like. In 1.8 Mojang introduced saving of Command Block syntaxes in held items, which in turn allows anyone with CommandBlock access to be able place down a Command Block with any command they please, no matter if they're OP or not.The latest version of Spigot disallows non opped players from placing Commandblocks.Another fix would be to remove Command blocks from executing anything, simply by removing it in the server.properties file.Hope this helped