Perhaps they did filter messages on the server as well. The client side word-list could be used for display purposes only, so if the user typed a censored word, the client could update the display with that word redacted and without waiting for a round-trip to the server.
They didn't -- the list was sent from the server, because "this list might need to be updated dynamically, in case someone on the Internet managed to think up a new word for sex."
Yeah but couldn't they just do the filtering in the server itself? Just like the Zbody hack?
The list sent was supposed to be used by the client to filter. What I think the OP is suggesting is that they should have just filtered server side not client side.
The list was maintained on the server, but filtering was done in the client. That's why it had to be sent to the client on every log in.