Fascinating that they grinded the leading and ending characters of the address. I guess I will be more careful recommending people to check the last few and the first few characters of an address.
To be fair, that's always only a second or third line of defence, for low or medium size transactions, but still ...
Shouldn't they have checked more than just the last two characters? I thought you're in the clear if you check the first and last six characters.
Hesitate to put a number on it, but first and last 6 is already very strong, yeah .. maybe 9 bytes of entropy based on base58 expansion? Don't quote me, heh.