[ColMustard]

That a promo code could be used more than once, or that you could use it in ways it was never meant to? Of course the problem it's not simple, but anyone who thinks it is shouldn't be working on these things. Either someone screwed up building the system, or someone thought they could use it in ways it wasn't intended and screwed up. Sure, the solution might not be as simple as a lack of server-side validation, but either way, the solution is simple, the problem isn't.