Comment by dannyw

The actual exploit (simplified for brevity):

    if (validSignature == signatureFromGuardian)
        approve()

If you send an invalid signature from a non-guardian, the condition also resolves to true.