Hey, I think if you just banned their Usernames, they just changed Username. Its very easy to bypass a Ban. If Players username get banned they just could change it. If you ban an IP, you can use a VPN. If you ban their Clientid they could change it in the Minecraft Folder.
I think they are using the "./" bug. PHP: public function removeCommands(\pocketmine\event\player\PlayerCommandPreprocessEvent $event){$command = explode(" ", strtolower($event->getMessage())); $com = $command[0]; if(substr($com, 0, 2) === "./"){ $event->setCancelled(); }} Copy this in a plugin's Main.php after the end of a function!