And like most security measures, humans are the weak link. The scanning system did mark the barcode as already used/invalid, but the staff assumed it was a glitch and let them on.