You probably just missed how one of their plays that generated an additional legendary—it’s unlikely to be from a hack.
There are several threads going, which discuss the plague of asian barcode bot accounts in Arena and the incoming plans for dealing with them:
Incredibly powerful cards in constructed tend to be a lot more broken in Arena, such as Pirate Admiral Hooktusk, who’s requirement to play seven pirates turns out to not be a difficult to accomplish for Rogue—nor is it difficult to synergize the card with a couple of Shadow steps or other forms of bounce.
I have often exploited the power of Mage’s Grand Finale (Summon an 8/8 Elemental. Repeat for each Elemental you played last turn), because it’s quite easy for Mage to play a lot of cheap elementals before turn 8.
https://imgur.com/a/qx1Yc82
Powerful quest cards, like Fire Plume’s Hearts (to get Sulfuras and Die,Insect) can easily become “I win” cards.
Other overly impactful cards in Arena include Dr. Holli’dae, Raid Boss Onyxia, Climatic Necrotic Explosion, Puzzlemaster Khadgar, Bloodreaver Gul’dan, Timewinder Zarimi (the fact that they continue to make cards like this or Wheel of Death demonstrates how little the devs have learned about making balanced cards), etc…