I was linked a troubling edit which I thought maybe was caused by a script at first, because the external links editor doesn't allow changing the source entity. After studying the code for a bit I realized there is a way to reproduce this:

1. Go to https://test.musicbrainz.org/artist/3135f6d0-9b05-4cdd-8786-f196108d6f62/edit and submit the form without any changes.
2. In the same tab, log out.
3. In the same tab, paste https://test.musicbrainz.org/artist/98af165c-cdf5-4033-8c72-c0189d46cdd1/edit which will direct you to a login form.
4. Log in using that form, and notice that the external links from the first artist have replaced the second artist's.

Reproducing this bug does not necessarily require the login step: the essential part is that the second request to initially load the edit page is a POST request rather than a GET request. However, I'm not aware of another way outside of external scripts to initiate such a request.