Or another option - there is something seriously wrong with cryptcoin protocol and/or blockchain (because it adds 10 CRYPT to one address but it doesn't subtract 10 CRYPT from the address from where it was (supposedly) sent).
The exchanges would have picked up on this instantly, so that isn't the answer.
Exchanges don't care or check from which addresses the coins come. They are only interested in that they get coins on the address that they control (they have private key).
I guess that there was human error (or multiple errors). You can't expect that the existing wallet will create "anonymous" transactions if this functionality hasn't been finished yet (and of course it cannot even theoretically be compiled in the executable file of the current wallet).
The exchanges do care very much, they check the addresses vs confirmations all the time for double spends
That's how WC was caught out.
I don't know what WC is and what technology it uses.
How can you check "addresses vs confirmations"? Confirmation is a number associated with one transaction. Address doesn't have any such number. Exchanges track confirmations.
It is not the job of an exchange to prevent double spends. They can't prevent or resolve any double spends at all. The network itself (protocol and/or blockchain and/or miners) needs to "resolve" double spends.
If CryptoNick's example is valid, then this actually means that CryptCoin network may actually allow double spends (but I seriously doubt this).
First CryptoNick spent 10 CRYPT for donation, but this probably didn't decrease amount of coins on his address (maybe it decreased number of coins on another address, but we don't know that). So that means that these 10 CRYPT coins may be sent second time to another addess. Voila - double spend.