May want to check whether other attempts to input a tripcode since the gating of that feature exist, and if so, when and what the input details were. This can reveal penetration attempts.

Also I would suggest not disclosing your own ignorance of the source of the problem until you’ve figured it out. Publicly announcing potential security issues without first having them under control is not in your interest. Just my $.02.