If you use auto-incrementing IDs as both primary keys and account identifiers, which a lot of web applications do, it might be possible to identify admin and employee accounts because they're more likely to have the lower IDs. A recent Steam hack relied on this to allow bypassing the approval process for Greenlight[0].

[0]https://medium.com/swlh/watch-paint-dry-how-i-got-a-game-on-...