Gerrit allows merged Change-Id's to be set active for review causing the CI integration to fail

Two review requests having same Change-Id can fail the CI integration, when the abandoned (because you cannot have two same) is restored after the other review request is merged.
Restored review: https://codereview.qt-project.org/#change,21131
Old merged review: https://codereview.qt-project.org/#change,21198

This caused the CI to fail with:
Subject: [Qt CI System Fatal Error] Cannot publish tested integration branch

Someone probably entered through the back door into ssh://codereview.qt-project.org:29418/qt/qtbase.git#master

This means Gerrit is really vulnerable for this kind of behavior which stops the whole integration process with a review which is not part of the integration testing.