But while they stated they would cancel duplicate bookings at the time, that's only regarding confirmed bookings. A user can still hold a booking for 48 hours while "booking flights", and with a 48 hour window its easy enough to time the release of said booking at the lowest volume booking period and attempt to snap it back up within few seconds with a second account.
Additionally, there is no validation beyond the email address. Name & passport are simple string fields, and you can have many different names / passports under a single account. That's all before you go all out and make 100's - 1000's of accounts.
I'm being a bit harsh, I was generally impressed with the quality of the booking system and how quickly they got it up. But once it's been out for a few months, and the cracks are starting to appear AND those crack become public it's just not good enough.
It becomes another class based system where: Priority 1) those with contacts within the department / ministry or some other method of getting special treatment Priority 2) those who can bot / exploit the system to get what they need Priority 3) those willing to pay to access priority 1 or 2. Priority 4) everyone else, ie: the public.
And this isn't getting tickets to a sporting event. This is "I want to go home to NZ because I've lost my job in Australia and I can't afford to pay rent" or "my mother is sick and I'd like to see her and spend a few moments before she passes". If priorities are to be made, they shouldn't be on class & connections.
Yeah the system is broken. Lots of people were running tools to automate bookings in order to find and secure a date, given how quickly they get snapped up. It’s marginally harder now they are using a captcha.