Wikimedia Bugzilla is closed!

A vandal (see <http://en.wikipedia.org/wiki/Special:Contributions/Malik_el_Sami_yn_Nasser>) was able to register a day after we were told the autoconfirmed threshold was increased to 10 edits, come back 8 days later and do move vandalism on a move=autoconfirmed protected page.

From what I understand this is a bug. Users should not be able to move semiprotected pages on their first edit because they should have to make 10 edits first before being able to. So first things, is this a design flaw, or is this by design. Or did the threshold just never actually get implemented in en-wp's LocalSettings.php file?

Thank you.