How the hell did they have read + write access from the temporary profile to the old one? Shouldn't the tenporary profile belong to a distinct, temporary user account?

Or the move opration immediately prompted for admin authorisation, and they just clicked through that? (not suggesting that these prompts are in any way useful for the average user)