[kbenson]

It's a fine grained distinction, but I thin kit applies there as well, to some degree. If exploiting the API requires leveraging knowledge of the underlying systems (buffer exploit, path traversal issue, etc) that aren't generally discoverable in normal usage, than that may be hacking. If it's a matter of the user discovering through normal use that through a normal set of operations that they have access to more of the same resource they already got (more money when they get some on a regular basis, in the article), then I don't think that's hacking, I think that's learning how to use the API you were presented.

Of course, I'm presenting this aswhat I think should be, not how it is.