I once worked at a mom-and-pop ISP back in the late 1990's. The previous sysadmin overloaded the UNIX password field in /etc/shadow to be used for account suspensions, when somebody wasn't paying their internet bill, the custom "Web UI" he built would allow the business owner to lock out the account by changing the shadow password field to "*", thus denying the user dialup internet access.

At least one customer figured out that they could call the girl at reception, tell her they'd forgot their password, and she'd reset the password for him, which restored his access without paying his bill for another month. He started to do this on a monthly basis.

The punchlines:

1) the front desk girl was the girlfriend of the business owner; you'd think they'd communicate about a customer who was getting away with this, and how they were doing it

2) the sysadmin who built this system went on to become a well known project leader for an major open source encryption project that is in wide use today