it's my understanding that anything made in Flash that depends on a timer to give a score is easy to hack in that you can mess with your system clock, or you can run other heavy apps to give you more time.
In this case a client wants a game whereby the user is showed a photo and they have to identify it as quick as possible.
I suppose I could do the timer on the server.
Any thoughts?
hmmm, of course all the user has to do is run the damn game twice and get it all right the 2nd time. God the internet sucks!
Using a server based timer will potentially penalize those with a high latency. There is also some tool that allow you to slow down the flash player and hack variables etc. So even if you were able to get around the 'get it right the 2nd time' issue you'll be faced with a whole bunch of other problems.
Is there a prize? If so then don't offer it to whoever comes first because it is likely to be a hacked score. Don't monetize the game, instead, offer random prizes.
This is how come you always get stupid high scores whenever someone posts another Flash game in WFG isn't it? 
Yeah I suggested letting the winners (those that complete the game that is) go into a prize draw, and just use the Flash game as an advert really.
This request for timed games/quizzes seems to keep coming up though, it would be nice to be able to sort it out.
I think in this case hacking variables and slowing down the player wouldn't help anyone because your choices will be judged and scored on the server rather than in Flash - so the flash player would never know the correct answers itself. And as far as visuals go, it's just a static picture of something and you have to pick the right one from three choices of what it is, so there's nothing really to slow down.
cheeky fucker... I only post legit scores. 
Sounds like you have most of the potential issues sorted out... except for the replay aspect.
FWIW I reckon any game can be hacked if the reward warrants it.... so just make your prize really shit 