The bug

You can use the /tellraw command without cheats. Although you can't evaluate selectors either in the command itself or the raw text object, you can still send messages to any user that look they they come from the game itself.

How to reproduce

Enter a multiplayer game without cheats
Type

/tellraw <someone> {"rawtext":[{"text":"§eHerobrine joined the game"}]}

To be even more sneaky, use a translation key to send localized system messages like this:

/tellraw <someone> {"rawtext":[{"text":"§c"},{"translate":"storageSpaceWarningScreen.fullduringgameplay"}]}

Your victim will see this false message, without any indication that it's a complete fabrication sent by you: