When Online Orders Cost Nothing: Lessons from a Platform Vulnerability