I have a vanilla minecraft server (1.8.7) and I've taken some measures to prevent hacking, but I still have people logging in and breaking stuff at spawn.

Here are some things I've tried to prevent hacking:

1. 
   Ops.json file is read-only, which is preventing people from adding themselves as OP using certain software.


2. Command blocks constantly change gamemodes from creative to survivor for anyone in creative that isn't me.


3. Command blocks kill any activated TNT in the spawn protected area.


4. Books and quills are removed from peoples inventories to prevent them from using them to hack.


5. The spawn-protection setting in server.properties set to about 70 (but people are still managing to break individual blocks somehow).


6. Ban people who are cheating (but I can't always be online)

I've also read that the Bukkit anti-cheat mods aren't 100% when it comes to hacked clients themselves.

Is there anything else I can do to prevent people from logging in and breaking stuff? I have some loyal players and I hate having to do roll-backs and make everyone lose hours of work on the server...

I tried giving everyone adventure mode using a clock, but the hacked clients seem to get around that somehow. I ended up solving the problem by increasing my spawn protection to a lot and also making sure the ops.json file was read only (even at the server level). When I need to, I can use root to set chmod the file and edit it and set it back.

Use a whitelist and player-vetting

Rather than being reactive and banning problem players, be proactive and restrict connections only to the people you personally allow.

Players can act as a vetting service for new players too: if they refer their friends, there's a level of trust and your chances of adding a troll is significantly reduced.

From the Minecraft Server/Admin Console:

# Enable/Disable the Whitelist
/whitelist on
/whitelist off

# Add/Remove a player to the Whitelist
/whitelist add <PlayerName>
/whitelist remove <PlayerName>

# List all players currently whitelisted
/whitelist list

You can also modify the whitelist manually, by enabling it in server.properties and then adding names to white-list.txt (or in later versions, whitelist.json). If you modify these files while the server is running you can force a reload without restarting the server:

# Reload the whitelist from disk
/whitelist reload

Note that OPs will bypass the whitelist, so no need to add them to the list explicitly.

Try making a redstone clock, and attaching a command block to it. In the command block, input this command: /gamemode 2 @a[x=(centre of your spawn X), y=(Y of your spawn), z=(Z of your spawn), r=(The radius you want) . That will give Adventure mode to anyone within the custom Radius of your spawn.