Fascinating that they grinded the leading and ending characters of the address. I guess I will be more careful recommending people to check the last few and the first few characters of an address.

To be fair, that's always only a second or third line of defence, for low or medium size transactions,  but still ... 

 Shouldn't they have checked more than just the last two characters? I thought you're in the clear if you check the first and last six characters. 

 Hesitate to put a number on it, but first and last 6 is already very strong, yeah ..  maybe 9 bytes of entropy based on base58 expansion? Don't quote me, heh.