There are kind of two things that happened, here. One is a kind of rushed implementation of a questionable feature. The other is a breakdown of social taboo of just violating the law and/or acting in a damaging way.
We all know that spam and bots are rampant on the Internet. But people providing their valid credit card numbers to then impersonate another company for trolling purposes is something that could happen in lots of cases but held in check by people knowing they’d be sued or arrested/fined. Exactly like vandalism.
(And there’s maybe an ethical case to be made for direct action/civil disobedience, but legally that’s not a valid excuse so there’s definitely risk of being sued and/or arrested.)