There were a couple of loopholes with staff which I've just patched so that they aren't possible anymore. All cases had to be corrected and everyone affected informed. If you got a mail about this, don't worry. Whether it was intentional or not nobody is going to be punished.
Less than five people were doing what could be considered actively exploiting the loophole. The figures indicate almost nobody knew it was possible, and most people were doing it accidentally.