I have seen some similar code. After authentication, a parameter was passed into the URL. Basically, if you had that token, you were logged in. Some user posted a link to their page on some site and included that token.

Later, the user complained about all of their photos constantly being deleted.

Photo deletes were GET-based and did not have no-follow. Google eventually indexed their logged-in link and was happily deleting all of their photos daily.

Fun times tracking that one down. (It was a code base that I inherited.)