It's possible. We did a cursory look for the destination address to see what was happening. If I were a whitehat looking to educate people I would publish the destination address with a message saying what had happened, and probably send the coins back to one of the testnet faucets. As it was it looked like our coins went to a single-use address and sat there, which seems like more of a black-hat strategy.

I don't remember the address we used, though. Here's [1] a similar one, for "correct horse battery staple" -- the funds were moved (in the same block) from the address to a single-use address where they sat.

[1] https://live.blockcypher.com/btc-testnet/tx/835509e51ab9054e...