One of my customer got a daunting experience the other day; similar to the way a lobster may feel the sudden drop in boiling water.
Bulk delete right is usually very restricted, but the culprit was a full power user with all rights and was confused by the way the interface displays the bulk delete options.
Let's look at an example, here's the view of contacts associated with a given account; as you can see (the orange circle), there's no contact record associated with that account.
Now let's click on the Bulk Delete button, you may believe this would only applies on the associated contacts of that account (even if the criteria does not displays it)
Now Let's click on Preview Records; this will actually delete all active contacts (not only the one of that account)
In that particular case, the user had some hundreds of associated records and thought he found a nice way to 'bulk delete' them but he actually triggered a system wide delete including the cascading records. It took him a couple minutes to realize it and get the sudden "lobster experience". We ended up restoring a database backup as thousands and thousands of records where already gone (bulk delete is quite efficient).