So there's always a way to write code somewhere that breaks your data. :-) Note that I view DDL as code as well.

If you insist on using SPs to manage integrity then you have to restrict access to the underlying tables. Whatever the problems with specification, they shouldn't have been able to do what they did. Two routes into that data were provided and they just happened to pick the one that blew things up.