Its not bug, just that people can kick anybody if they want.
Nope, according to Urban Terror forum:
Seems there is an exploit being used that gives an unknown individual ... access to your server where he or she can use your rcon commands.
So the hacker can use all kind of rcon commands, not just kicking anybody.