It is possible someone was able to trigger a hashed collision of UIDs. Though it would be very difficult, I imagine, to control when an opportunity to do so existed. You would need the ability to spoof a wide range of IPs to the server and one of those would have to collide to create the same UID on a bread that Q happens to post in.
Speaking of things I noticed, it was that the bots tried to keep an average bread flow rate of around a minimum of one bread every 2 hours in the ranges when Q was active. This would have served to narrow the useful window of such a setup and to make it more expensive to do so.
That said … It could also be that Q left 'unofficial drops' just to give the types who would try and invent them something to chew on. People are biased to presume favor on their part (else we would never take any risk and therefore never try to succeed in risk) - so when they see 'easy pickings' to satisfy their objective, particularly when it comes to social behaviors, they always assume it is the error of others, rather than part of a deliberate ploy intended just for what they are about to do.