Comment by ryanlm

I'm assuming that the relevant code, is simply an if statement checking for the existence of the url parameters, not even checking if the security questions are correct.

    if(isset($_GET['securityQuesiton0')) {
        // success, 
    }

This is negligence on the developers part and I think they should be disciplined.