The only thing that's truly suspect is that the candidate was told their code was accepted into the codebase. I can't imagine this is terribly uncommon otherwise: it's more likely that it happens without the disclosure.