You were exploiting a bug, an egregious one, and I don't think any reasonable person would think that behavior was the intent of the service provider. In other

You were exploiting a bug, an egregious one, and I don't think any reasonable person would think that behavior was the intent of the service provider. In other words, "the code let me do it" isn't going to fly in court. To your original question, entering a negative amount in a web form should not be illegal. That's silly. But you're responsible for the effects and what you do after noticing the odd behavior. If an ATM machine vends me an extra $20 because the bills were stuck together, I should return the extra $20.