There should be application level auditing and database level. The people with access to managing the database level auditing should be extremely limited.
They were not able to do the first thing about running a transaction (ensure that one side of the transaction isn't executed multiple times). What you are saying is an obvious thing and yet it probably is well beyond the maturity of the team that was working on it.
