Castro's script and your original will work no matter the player is admin or not.
Try this:
function dmg(thePlayer)
local account = getPlayerAccount(thePlayer)
if not account or isGuestAccount(account) then return end
local accountName = getAccountName(account)
if isObjectInACLGroup ( "user.".. accountName, aclGetGroup ( "Admin" ) ) or isObjectInACLGroup ( "user.".. accountName, aclGetGroup ( "Moderator" ) ) then
local car = getPedOccupiedVehicle (thePlayer)
if isVehicleDamageProof(car) then
setVehicleDamageProof(car, false)
outputChatBox("Your car is mortable", thePlayer)
else
setVehicleDamageProof(car, true)
outputChatBox("Your car is immortable", thePlayer)
end
else
outputChatBox("You have no right to use this command.", thePlayer)
end
end
addCommandHandler ( "damage", dmg )