Slightly related but very interesting: the 2010 Twitter bug where simply tweeting "Accept [username]" would automatically force them to follow you. My understanding is that for the sake of simpler interfaces such as SMS, which they let hold the whole service back for a long long time, they had a "follow [username]" feature - and if the person had to approve follow requests, it would send one to them. To accept the re…
I wrote a script to accept invitations to every group ID from 1 to 10000. It even added me to groups that didn't exist yet, presumably just adding my ID and the group ID to a table. So when someone created a group to rant about me being in all their groups, I was in it and, as the first member, an admin.
Facebook fixed the bug when I reported it and first kicked me out of my legitimate groups, then fixed that too, though they didn't pay bounties then.