They are not hacking the leaderboard. They are posting fake http-requests with fake scores to the leaderboard. You can't do anything to prevent this. The only solution I know of is to encrypt/hash the scores, but this can still be hacked.
.
I remembered a story I witnessed a few years ago. A big international travel organization held a contest on their Facebook page. Every day they posted a video clip filled with small clues about some place anywhere on Earth, and you had to find and tag this place on Google Maps. They were giving $1000 to the fastest winner every day and a grand prize of $10.000 on the final day.
I tried my luck a couple of times and it took me about 1-2 hours to find the place. The winning times were under 1 minute! It was impossible to even watch the entire video in 1 minute! So people were obviously cheating. The organizers ignored these accusations until someone posted detailed instructions describing how their contest was hacked. Needless to say, thousands of people who spent days trying to win money were furious..