Fixed.
Although I don't even know exactly what the exploit was, I think I have a FAIR idea of how they decided who to punish...
From what I'd judge, (it's actually something I've not actually tested with in RunUO yet) the staff *can* tell when people modify their houses. As I recall, house designs, until saved or committed/built, are *not* stored on the server, and are only client-side, so at the very least, committing a design would show as a large bandwidth spike. (I might be wrong, though)
At any rate, the staff would be able to check who was modifying their houses a lot, and also keep tabs on their bank balance... It'd then be pretty easy to tell who was exploiting it, by simply noting who was repeatedly modifying their own house(s) with a rapidly spiraling bank balance, with no other activity. This would leave out those that got their money in a legitimate manner.
Likewise, I'd bet that for those that might've accidentally STUMBLED upon the exploit, but didn't intentionally use it, would be easily noted by the fact that they only modified their house and gained from it perhaps once or twice. And I'd predict that the staff likely didn't do anything against those people, since it could be safely assumed that they were innocent of intentional wrongdoing.