I am currently developing a multiplayer game for a university project. The purpose of the assignment is to learn about the use of a cluster architecture, but I have a question concerning security.

The multiplayer role-playing game that I'm developing for class utilizes a client-server architecture. The client holds all of the game assets and a 2D game engine. The server provides authentication to log into a user account, provides access to characters and their progression, etc. The server also provides the positions of non-player characters and other players on the same server, and also provides their actions and movements.

My question is whether a tech savvy user that modified the source code of the client could "play the game" without authenticating, forcing a kind of single player version of my game? I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot. Maybe he/she would simply want to move around the game world freely.

1) Does this scenario seem possible?

2) Most importantly, what harm could this cause to a multiplayer game? Perhaps I have content that I don't want someone to be able to access without properly purchasing the game, or if they have been banned for some reason.

3) If this is a problem I should try to mitigate, how could I go about preventing this kind of thing from happening?