[douglas]

Only the game host can do anything directly to the .gam file. Players can only upload .plr files, and the only one any player could possibly make that would be valid is for the human player, unless they manage to guess your game master password. I don't know exactly how PBW handles those uploads, so it might be possible for a player on the waiting list to upload a turn and have it overwrite what the current player uploaded, but if that happens you can just kick the offending player and not allow him/her back in. Players can't upload anything until they've been approved by the host, so you can easily just withhold approval from any rulebreakers trying to get back in.