I didn't want to post this here until we had finished our investigation but the user did indeed exploit us. I extended an offer to kekeke to return the funds before I post all our findings. I have a feeling you'll see an update from me tomorrow.