Ouch. Somebody should teach them about this novel database concept called a "transaction".
DDoS or not, it should simply be impossible for something like this to happen.