Subdomains of hosted domain
If I have registred user in ispconfig panel with somedomain.com as another client I can create subdomain in somedomain.com and have control over it. It's in my full ownership, there is no mechanism to check subdomain delegation exists or something like that. Application - without any checks - create subdomain and give administration of that domain to user which is not in charge of domain (i.e somedomain.com)