How the hell did that even happen?
Yeah, so, um, embarrassing.
After theory posted that log, I was curious if there was a bug or exploit or something (it's a year old, but I didn't remember fixing anything along those lines), so I wrote to the player and asked him, and while I waited for him to reply I went reading through that section of the code.
Turns out that (until last night) the server didn't actually check to see if you had enough money to buy the card you asked to buy. Normally it's not a problem because the interface only makes cards clickable if you can afford them, but if you hack the javascript, or insert a proxy that modifies the request on the way to the server (as bdhcompany did) it would happily sell you any card in the supply whether you had the money for it or not. Whoops!
Anyway, bdhcompany was cool about it, that game was apparently a joke he was playing on his co-workers. And it's fixed now, so this shouldn't be possible any longer.
No, I'm not going to do anything about past games. If anyone was using it regularly, I guess we'll see a precipitous fall on the leaderboard soon...