I mean account.allow_negative doesn't sound that nefarious. Could even be useful for some testing scenario, the fact that this flag was enabled on a real production account is what is bad.