Disable their client side validations and find out if they bothered with server side validations...