I want to report that it is fairly simple to hack (just trick really) the system, and assign any hat to my avatar.
I cannot earn any hat, but I can wear one as if I had earned it.
It happens because there is no check made on the back-end if I have actually earned the hat yet. If I pass the right ID I wear it.
This is not a manipulation of the sprite's CSS for my own viewing. The hat is really assigned, and I wear it everywhere.