It's being used unintentionally to do things it wasn't designed to do... isn't that hacking by definition? Missing Auth is a typical finding.