client side hittests are extremely stupid in an open source game (they're stupid in closed source games too btw), and as odin mentioned, there's a better solution (one that has been in svn since revision 866): every client command comes with a time that matches up to the server time, normally the server would just ignore it, but with some code based on unlagged (a q3 mod by Niel "Haste" Toronto), the server instead rewinds time to the time the shot was taken, checks if it hit anything, then puts everything back before anyone notices (though this only applies to hitscan weapons).