I'm really curious why not make the AoE damage something client-side. I mean, let the client do all the calculations and send the result to the server. It makes cheating easier, but ends this annoying problem.
Basically, when the client receives information about AoE, the client checks if the player is inside the area or not. When finished, send results to server and the player takes the hit or don't.

PS: Probably unfair for PvP, but just talking about PvE and dungeons here.