Is 23,148,855,308,184,500 a magic number, or sheer chance?

It's also possible that they first submit a request to check if $X is available, get the confirmation that it's okay, and the submit the actual request for $X. In that case the bug may have been in the way the 2nd request is handled.

I'm not sure why more people wouldn't be affected by this though.