They are probably getting a full refund of both the $10,000 and the $9,975 purchases. Eventually. It's
possible they'll get $25 and $9,975 back and end up with $10,000 in bonds total, though I'd doubt it.
The website not stopping or warning you is one thing, though I think the real change needed here is on the backend: when executing the order it should check your limit before trying to transfer the money.
The way they're doing it is probably safer for them in terms of races or whatever, and who knows what ancient Treasury system it's probably interfacing with, but still.
