Props to the guy that figured it out on StackOverflow! I still wonder about how that transaction got through without triggering a fraud alert.
It's also possible that they first submit a request to check if $X is available, get the confirmation that it's okay, and the submit the actual request for $X. In that case the bug may have been in the way the 2nd request is handled.
I'm not sure why more people wouldn't be affected by this though.