A replay attack works by blindly re-using an earlier message or ciphertext, or fragment thereof, typically one that was encrypted or signed. A simple example would be a bunker which receive the encrypted message "I'm General X, open the door". Now if this encrypted message was captured a week earlier and replayed by some opponent, well you get the idea.
This works against many schemes that (wrongly) use encryption when authentication is sought, or/and forget to associate the signature of something with a date or incremental counter. Such vulnerabilities are quite common. An example is a device that produce an RSA-signed log of incidents not including a date of generation of the signature: it might be possible to hide recent incidents by replaying an earlier signed log, instead of the current one. Moral: Neither encryption nor signature prevents replay.
For every block cipher operation mode, a replay attack works if the full message (including Initialisation Vector, if any) can be replayed.
When portions of an encrypted session using a unique session key are replayed, some modes are more vulnerable than others. ECB is particularly vulnerable because a repeated ciphertext fragment will always decrypt to the original plaintext. Apparently, in the attack given in the question, the encrypted message fragment triggering experience points was captured at the beginning of a session, and replayed, and this worked because of that property of ECB.
This is true to a lesser degree with CBC and CFB, where the first block of deciphered plaintext from a replayed ciphertext fragment will start with one block of garbage. The attacker, knowing that, will replay one more block of ciphertext before the portion corresponding to the plaintext intended for reuse, and success or failure of the attack will depend on how the receiving end handles that particular garbage.
Some other modes (like OFB and CTR) do not exhibit the property that replay of a ciphertext fragment yields the original ciphertext. They may still be vulnerable to replay attacks, e.g. if the IV can be repeated also.