A one-shot action leaves its enabling state set (an approval, a pending request, an open round) after execution. The action can be repeated because the guarding flag was never cleared.
// executeRequest(id) runs but leaves requests[id].active = true. // caller re-runs executeRequest(id) -> the payout happens again.
delete pendingRequest[id]; // clear before/after executing
_execute(id);
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0250 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.