The way anyone gets by UTDC that I know of is this:

1. Change the hooked address to something UTDC doesn't check (requires bot code changes or creation of a new bot).
2. Change their local UTDC files (UTDCXX.u, UTDCXX.dll) to send false info to UTDC on the server.
3. Start up the bot AFTER the initial UTDC check badge is gone.
4. Change the name or code usage of an UnrealScript bot.

I've tried to prevent #1 by tracking down bots and adding the addresses in UTDC.ini.  Theirs MD5 checking for #2 but it isn't 100% uncrackable.  #3 is done by reducing the check frequency but still people can get by sometimes.  And I have (or had) a modified version of ASH on the server to help prevent #4- you have to track bots down and add them to the list.  I've also had UTDC do more checks for #4 but I had to take it off since UTDC was fucking up.  Once we figure out a way to block a cheat a new cheat comes around that is able to bypass the checks.

He was using a well known cheat.  Something that very old versions of UTDC will detect.  This cheat is downloadable for free on almost any UT99 cheat site.  If he wanted to test anticheats he should of contacted you or us about that BEFORE he decided to do any tests.  I'm not sure about keeping him around but changing his name may help.  Although it could be even worse for us once people figure out who he is.  His IP/Location/ISP will still be similar- nothing to stop people from figuring out who he is.  I'd watch him if we keep him, like BK said- keep him off other servers for awhile.