The ampersand is a functional character in HTML, and must be turned into an escape sequence--which begins with an ampersand. I see evidence that the story data store here is HTML-based--for instance, the way that tagging text in an inline review cannot cross a paragraph boundary and sometimes extends beyond where you want it to. The enforced boundaries (which include places where font changes occur --or previously occurred) are consistent with behaviour based on HTML-represented text. HTML representation means that the certain text characters--especially the ampersand and the angle bracket--must be 'quoted' by turning them into 'escape sequences'. HTML has a specific name for its way of doing this, but it's a general problem in programming, and computer science has studied it. What happens when you want to 'quote' an escape sequence? Whatever interprets the HTML text has to know at each point whether it has escape-processed text or escape-unprocessed text. And that's a place for errors, and a place where malicious code attacks too often succeed. (This is not a secret, but a basic dimension of the problem.)
So Dirk isn't drunk, isn't tripping, isn't seeing UFOs. What he's reporting is a very plausible fault pattern.