Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.

But is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?

I think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.

Probably the same rather random place where $5000 got pulled out of in the first place