There are numerous ways to do it.
There once was a "crasher" for the retail version that let you enter a server and kick out almost everyone. I remember I tested it on the biggest server with 50 players, only 10 were left there 20 secs after I started the tool. People also got a box with "greetings from TKC".I think I used some bug that had to do with texture/model recognition. We also created a simple protection (using our marionette site VCAC- Vietcong Anti Cheat) to stop people from being kicked out, but people who used that defence got cheats enabled themselves (superjump etc) hehe.
Lol I actually found the VCAC site
http://www.geocities.com/vietconganticheat/If you want to take a look at how it works just download the "gamewinnerpack" from the main site. Tip: The DLL files are not real. Open them with notepad. The trainer was created with TMK, which means you can use a trainerspy to get the opcodes and/or adresses. You could do the same thing with the demo then. But you need to know how to create trainers first.
This "crasher" was the only possible way to mod the game without extracting it back then. You could have people use superjumps etc, only by downloading that pack.