Yeah the system is broken. Lots of people were running tools to automate bookings in order to find and secure a date, given how quickly they get snapped up. It’s marginally harder now they are using a captcha.
But while they stated they would cancel duplicate bookings at the time, that's only regarding confirmed bookings. A user can still hold a booking for 48 hours while "booking flights", and with a 48 hour window its easy enough to time the release of said booking at the lowest volume booking period and attempt to snap it back up within few seconds with a second account.
Additionally, there is no validation beyond the email address. Name & passport are simple string fields, and you can have many different names / passports under a single account. That's all before you go all out and make 100's - 1000's of accounts.
I'm being a bit harsh, I was generally impressed with the quality of the booking system and how quickly they got it up. But once it's been out for a few months, and the cracks are starting to appear AND those crack become public it's just not good enough.
It becomes another class based system where: Priority 1) those with contacts within the department / ministry or some other method of getting special treatment Priority 2) those who can bot / exploit the system to get what they need Priority 3) those willing to pay to access priority 1 or 2. Priority 4) everyone else, ie: the public.
And this isn't getting tickets to a sporting event. This is "I want to go home to NZ because I've lost my job in Australia and I can't afford to pay rent" or "my mother is sick and I'd like to see her and spend a few moments before she passes". If priorities are to be made, they shouldn't be on class & connections.
There are multiple issues with the booking system which enable this.
I’ve notified them of these issues multiple times, they did nothing.
It then became news, and was reported publicly multiple times, and still there were no changes.
Before this vulnerability was widely known making a booking was not all that difficult. After it became widely known there was not a single booking available in the system.
Go figure.