Well, a person who doesn't have enough knowledge to find the required tools shouldn't be able to do any real harm. If he can then the person in charge has way more serious problems coming his/her way.
And if he's trying to use alternate ports to run blocked services, an alert network admin can pick it up and ban it.