Personally I'd check if they were in the hit-box on the client-side then pass that list to the server, and do level/distance checks with a slight amount of leeway and hit them accordingly.
We had a system like this on Zodiac a year or two ago and our sword users would lag the server to hell because of the unoptimized script.