This affects at least 13 other champions that I know of. It's a bug where you can inject packets to the LoL server and it won't do simple validations like what level you are or whether or not you actually know the skill you're "using". There's a similar problem with summoner spells, which allows you to use spells that no longer exist, and these issues have been off-and-on for years. It's rather surprising that people are getting away with using them, though.. I haven't actually seen them used in real games, but I had an ARAM match tonight where the TF was throwing 2 red cards per AA. I think this calls for disabling at least these champs: Ashe, Brand, Ezreal, Fiora, Gragas, Jax, Lucian, Lulu, Pantheon, Twitch, TF, and Varus.
If there are any other champs, I'm sure there's an up-to-date list on reddit. Riot, you kinda need to worry about this. If all these posts about people having exploited this in 50+ ranked games are true, we may need to roll back the ranked ladder a day or two, or something.