And to be blunt, anyone directly screwing with the CVS repository should know these things.
Fortunately, sounds like nothing irreversible was done! If people want it to be fixed, it can be fixed, the repository files can simply be copied (not moved) back to their old location, and cvs rm'd there.
Now, the modules file, that does sound trickier, and I've never used one myself so I don't have much useful to say. You really can't version it and tag it, or something like that? That is yet another serious CVS mis-feature then.
Also, "No direct manipulation of CVS repository without a TIP" seems sort of silly and overly bureaucratic. However much we wish it wasn't so, there are things CVS just plain doesn't let you do any other way - there can be good reasons for a maintainer to directly manipulate files in the repository. Not regularly, probably never even often, but I've done it myself often enough times in the past, at work and etc...