My understanding of that was that the individual in question (was there more than one person?) clicked through confirmation screens without looking at them, assuming that everything would be okay. It is not Google's fault when users are idiots.

However, I may be wrong; I only recall one instance of this happening with Buzz, and may simply have missed other ones.

Other times when google violated privacy which I remember: 1) Accidentally logging packets, which they then told people about and found a good way to delete, instead of just pretending it didn't happen. 2) Releasing emails (and other information?) to governments when required to do so by law, which I consider a valid excuse.