This is how I stopped ForceOP.
Option 1. Dont give anyone any perms that can damage anything. Then just deop yourself every time you log off. So when the hacker tries to use your player to op themselves, there are no perms.
Option 2. Use a separate authentication password plugin. Make sure all players with perms that can be used to damage the server use the secondary password system. I have been using the loginsecurity bukkit plugin.
The forceop works when the hacker does a "session steal" and tricks the console into making the owners or other op player op the hacker.
