That's a tough one! Try validating on the server to see if the server is catching the validation and not the client. Just for kicks, at least!

It almost sound as if he got javascript turned off but is tricking your server.