It's possible to create administrative account by replaying creation request with different username.
vulners.com/securityvulns/securityvulns:doc:15324