You could write a setuid wrapper client that as root or an admin account can relate their local login to the file owned and only readable by the admin account. What sorts of clients do they use? ...
Yes, it is because of the 777 permissions of the parent directory.
If you were to set the "sticky bit" on the parent directory file this will stop a user deleting something they do not own. See "man...