Symptoms
Provider created promotion activated by promo code and entered promo code exactly as 5percent in hope that only this code will be valid to get promotion.
However, a customer entered promo code as 25percent and promotion was applied to their order despite of the fact that customer entered code which is not exactly the same as Provider set up in promotion.
Moreover, such codes as 5percents, 15percents and other similar ones also allow to get promotion.
Cause
Actually promotion code is regular expression mask. All values which are listed above match to the regular expression Provider set up in the promotion, that is why promotion was applied to orders.
Resolution
If you want to define the exact string as promo core, e.g. 5percent, then define promo code as ^5percent$, the only string which matches to this regular expression is exactly '5percent' (without quotes).