I'm assuming that the relevant code, is simply an if statement checking for the existence of the url parameters, not even checking if the security questions are correct.
if(isset($_GET['securityQuesiton0')) {
// success,
}
This is negligence on the developers part and I think they should be disciplined.