The information leaked was most probably a few views/menus. He's only tricking the client in to thinking he's an administrator, not the server.