Opening the book…
If a measure can be met the cheap way, someone will find it, and the next person in that seat will find it again. Treating it as individual misconduct removes one person and leaves the hole open. It also teaches everyone else to hide what they have discovered, which costs you the early warnings you most need.
When you find gaming, first write down the exact route taken and close it in the definition or the collection method. Ask the person who found the route to explain it, and make clear that reporting a weak measure is rewarded. Keep disciplinary response for cases that involve falsified records or harm to someone, not for cases that involve taking an incentive at its word.
Fabricating data, altering records, or concealing harm is misconduct regardless of how weak the measure was, and should be handled as such. Someone who keeps exploiting a route after it has been named and closed is no longer revealing a design flaw.