The culprit really should take this route & claim a possible reward:

"the user that took advantage of this bug, we would greatly appreciate if you share how this trick was done 😁"

<<This is the way>>