The 600k airdrop was sMerit, not Merit. The total amount of airdropped Merit is much larger.

There was at least one incident in which theymos undid Merit transactions by sending "negative sMerit", and another in which he simply removed the original Merit transaction. In that case, a hacked account was used to send (I think) 3 times 50 sMerit, but I can't easily find back the reference thread.