Pointing fingers isn't gonna help.
Whoever coded it is to be blamed. He accepts his mistake, be the better person and forgive and forget and move on.
Whoever tried to abuse it ofcourse knew the situation was in error, so obviously this was done either for profit or just for fun. Doesnt matter. As true as it is that it was the coders fault, being tempted to spam boxes isn't a wrong thing, but having malicious intent while trading or costuming that stuff and all is morally and ethically wrong. Whoevers fault it may be, it is upto each and every person to realize how strong is their moral Fibre, also it is upto to rule makers how to treat the rule breakers, punish them or just undo the damage and make sure the thing doesn't repeat. Whereas a light rap on the knuckles like a one or two day ban is completely at the discretion of the rule makers, it's a gray area on if it should be needed or not.
Let's not mix issues here with other balances and stuff and to be in point, try to implement things on Thor like you did it earlier before releasing it onto the most popular server like loki. I'm sure people would love to test out stuff as they have in the past and will help the server grow in a positive way and without hiccups and such stuff which make your life harder than it already is for you.
Im sure you have got these suggestions from other too, but I dont wanna assume and share.
You guys are doing an outstanding job otherwise, just don't rush things. Be cool.
Have fun. GG.