It's a good system. The fact that the hacker crowd hasn't even figured out the basics yet is amusing.
MetroCards are validated by both the station computer and the central data center. Once a card has been used, it can't be used again for 18 minutes. This makes copies of cards almost useless. There's a lot of mutual mistrust designed into the system. The MTA isn't stupid.