There is currently no way for a user to remove their own packages or unpublish packages anymore from the public NPM API ( a change following the `left-pad` incident ).
This leads me to believe this was an internal NPM error. My guess is employee error.
Yeah, it definitely exists: https://docs.npmjs.com/cli/unpublish
A quote from the documentation page you linked:
> With the default registry (registry.npmjs.org), unpublish is only allowed with versions published in the last 24 hours. If you are trying to unpublish a version published longer ago than that, contact support@npmjs.com.
Apparently, someone can remove established packages.