When a registered user submits a vote in viewtopic.php, the code reads their existing votes from poll_votes with no lock. It then inserts the new vote rows and updates poll_option_total as separate statements outside a transaction. If the same user sends several vote requests at once (for example by double-clicking, or with a script), each request can see “not voted yet” and record its own vote. The user ends up with more votes than allowed, even in single-choice polls or where vote changing is disabled. The option totals can also drift out of step with the vote rows.

The extra votes can only be cast in one burst per user per poll. The duplicate rows stay visible in poll_votes, and guest voting depends only on a cookie anyway.