Is the portion of the code the user can hack being run in a separate sandboxed execution context, or can the user really change everything written in Lua should he try hard enough...?

Brandon (I think that's his name) actually went out of his way to avoid sandboxing and deliver the premise as authentically as possible. He's talked about it in a few videos in more detail - https://www.youtube.com/watch?v=1FgC_284eNU#t=88

I didn't know that! It looked like a carefully prescripted game feature, but decompiler and real assembly make it even more interesting. :) (I already bought the game)