Notes/Domino 6 and 7 Forum : Editor-level server replicated Design changes

We had an incident a week or 2 ago which has left us puzzled. We have a global network of around 100 servers, arranged with a global hub, which replicates to a number of regional hubs, which in turn replicate to local spokes. The spoke servers have Editor access to the NAB, and the regional hubs have Manager access. The global hub is, naturally, the admin server and also has Manager access, with incoming design replication disabled. This allows us to push out design changes as required (such as migrating to an R6 NAB, but prevents any changes coming back and corrupt the network. Or so we thought.

Someone made changes to the design on one of the spokes, at the console level, ie, when the server was down (we think the personal NAB template was applied). This replicated back up to the relevant regional hub, and was propagated throughout the rest of the region. Only having incoming design replication disabled on the global hub prevented a complete corruption of the NAB throughout the network.

So, my question is, how on earth was a server with Editor access able to write design changes by replication, namely 8 views added, 27 updated, and 61 deleted? The elements were signed with the Lotus Development signature, as they'd come from a template (obviously, this is not an id, just a signature that is only relevant to ECL matters).

Has anyone else seen this behaviour? Is it an error in the code? If the latter, and I can't honestly see it getting past quality control, it's one hell of a bug.

Any light shed would be of tremendous help in locking our network down.

Cheers,
Dave