He could have just picked "x" number of random users to have nonces skipped for, and it just so happened that the first one to notice was a whale and the rest didn't actually bet until it was discovered and simply never bet anything while the code was in effect.
By "not having DB access" they could mean that the employee did not have the ability to write/make changes to the DB but could "read" the DB. If this was the case he could simply pick "x" number of users who would bet large amounts.
He could have used the bet verifier to check how much was wagered on random bets by each user and picked users who had made large bets. (I have not actually used the bet verifier prior to when they disabled it so I don't know if this would actually make sense)
All this could explain how he decided which users were best to target.
None of this explains how he then *manually* targeted those users.
It could be something along the lines of "this code only applies to users "X" "Y" and "Z" (I am not very familiar with the specific code used so I don't know the exactly language).