A situation like this can arise without new features, whether grafted onto an existing form or not. All it takes is a use case for which the system was not desi

A situation like this can arise without new features, whether grafted onto an existing form or not. All it takes is a use case for which the system was not designed (which seems quite likely here), but which can just about be accomplished by abusing the purpose of the existing system. One software-independent thing Citi could have done that might have reduced the risk of procedures like this would have been a rule that the reviewers must reconvene, and all concur, before proceeding past a warning.