How does this happen? I realize it's a small percentage, but this is one of the first tests you build. Even 1 photo (not to mention this is regarding videos) should never make it to another non-authenticated user. This is a massive mistake.
For that matter, software itself is full of surprising and undefined behavior, so it really shouldn't be a surprise that large corporations sometimes have "simple" mistakes that appear really big. That is just software in motion.
I strongly suspect there were more problems in the system than just toLower(), or else the system was hosting significantly more than a quadrillion images. Your mention of "or just incrementing" sounds much closer to the mark.
1: I interviewed a HORRIBLE candidate and told my boss in no uncertain terms not to hire the bozo. Then, I look at my colleagues and explain how poorly the interview went.
2: I go away for two weeks to have surgery
3: I come back and learn that we're hiring the bozo
4: My boss asks me to do some pair programming with the bozo, and he doesn't understand some very basic concepts
5: I hear the bozo is debugging webservice code in production
6: We had a data leak from one of the bozo's bugs
From what I remember, it was a very dumb bug based on clear misunderstanding of fundamentals.