Okay so this time I have tons of screencaps. Preston2005 is the main culprit but there are others include in some of the following screencaps. Peanutbaby9 and SlyfoxHomieAZ Also witnessed the plot.

Actually, End portals and Nether portals aren't considered as hacked items. They can be acquired with /i. I also couldn't find any hacked items in their inventories or enderchests.

pat what about the spawner

You're right, spawners aren't allowed. I've updated the blacklist now so that spawners can no longer be placed (my fault for not doing so in the first place).