Props to the guy that figured it out on StackOverflow! I still wonder about how that transaction got through without triggering a fraud alert.

The bug may have occurred after the payment was accepted if it's a multi stage process.

It's also possible that they first submit a request to check if $X is available, get the confirmation that it's okay, and the submit the actual request for $X. In that case the bug may have been in the way the 2nd request is handled.

I'm not sure why more people wouldn't be affected by this though.

The biggest bug is the fact that the program itself didn't look this result over and scream FIX ME!