if you read it right, it was a bug and that guy exploited the bug. If the site is scam, then the person exploiting the bug can even be held guilty in legal jurisdiction. That's called scamming and not informing the owner of the site and looting him illegally
