It looks like it intentionally didn't have any protections in place. The edit page has the comment
<!-- Feel free to take advantage of the lack of CSRF protection -->
It also has <h1>What could possibly go wrong.</h1> go wrong in the default editor source.
Was it irresponsible? Yes zq should have put a warning for sure. Still a cool experiment. Twitch Plays Pokemon with bigger repercussions.
To the dumbass downvoting me: I just took a look with wget and the current homepage will set you in a loop that starts up endless mailer windows until your machine crashes. Good luck.