Basically, the only thing sent to the server are mouse clicks and keystrokes, which should make cheating difficult. In the past, people have used macros or programming to flood the server with mouse / key input, which caused performance issues. I now rate limit input, so if too much is sent too quickly it is just thrown away.