I’ve just looked at the August one and that includes node IDs over 25,000,000 so I don’t think it’s the same sort of thing. I suspect that that was a “normal” node drag that is all too easy to do in JOSM.

I don’t think it’s an API bug - that pretty much just does what you tell it to, and if it “occasionally updated the wrong object” we’d know about that by now.

With JOSM you could argue the case that it should at least have displayed a suitable warning dialogue in front of the user, but of course we don’t know that that didn’t happen. With a DWG hat on I often use JOSM to break referential integrity in the data when doing a revert, because “how well things are mapped” will still be better afterwards than before. JOSM’s conflict resolution dialogues are actaully enough of a pain for me to tend to use the perl revert scripts for larger reverts, and patch up the problems afterwards. It’s really a question to which there is no right answer.

Although faked version numbers of JOSM (and iD) are definitely a thing that spammers et al sometimes use, I have no reason to believe that either user here was using other than a “normal” copy of JOSM.