Sounds like web designer's fault. No permission check and no confirmation for deletion?
> Never, never delete with a GET. The Ultraseek spider deleted 20K > docments on an intranet once because they gave it admin perms and > it followed the "delete this page" link on every page.
