This was easier than I expected, really.
Seems like these addons simply use the scripting interface to send | (pipe), bypassing the client's auto-escaping of it. The client sends your regular | as ||, but using /script SendChatMessage() you can send it by the altcode, bypassing the interface.
Pretty clever, i'll give them that.
I already added it to the Aspire SVN, but since most people don't read the logs I'll post it here:
Yep, it's that simple. It will intercept any color message sent by ColorMe, giving the default "Your message has been blocked by a server-side script" message.Code:INSERT INTO `wordfilter_chat` VALUES ('\|{1}c[0-f]+', '\|{2}|\|Hitem');
Greets fly out to the wonderful exploiters, you brighten up my days <3