Just to circle back to this (since I finally have time to catch up on
email), and since the ticket was private:
We hotfixed a fix for this right after it was noticed and now it's
in the upstream pagure-dist-git release as well.
Only admins of a package can orphan it.
Let us know if you see any other behavior here.
kevin