The bug may have occurred after the payment was accepted if it's a multi stage process. It's also possible that they first submit a request to check if $X is a

The bug may have occurred after the payment was accepted if it's a multi stage process. It's also possible that they first submit a request to check if $X is available, get the confirmation that it's okay, and the submit the actual request for $X. In that case the bug may have been in the way the 2nd request is handled. I'm not sure why more people wouldn't be affected by this though.