Might be unrelated: If you put a servercmd in the callback_playercommand BEFORE calling the player playercmd() function, the actual function the player was executing gets overwritten and replaced by the servercommand, which would thus allow for menu-free execclientcmd()

Might be worth looking into next