This post alerted me as well, however we are half-way on TCA v2, and our TCA v1 servers run using dimitri user per server method. I can say this post increased our migration to TCA v2 and I think we're almost done.
Oh yea, this works by customers not securing their server. Instead of uploading a spray, he can upload a virus, which will therefore exploit GameCP and TCA v1 by default because of the service running as Local System, at which point he gains control of the box.
The fix is easy:
sv_download 0
sv_upload 0
If you run SourceMod, installing this extension is a good idea as well.
http://forums.alliedmods.net/showthread.php?t=142249
And you should remind customers to never share the rcon password and rcon command.