Adv. Guestbook BIG problem !!! Maybe BUG there!

somehow the visitor succeed to place the following code in new entry:

Thus he hacked my guestbook ... you can imagine what happens when this code loads
HTML codes are disabled, AG codes are enabled, and when I'm trying to place that code myself on new post, I cant ( it says that message contains invalid words)

But somehow he DID it and overcomed all restrictions !!!

How is that possible and how can it be corrected?

That can be a big problem, although I've censored words javascript and script ...