I've found a bug in the version 1.33a that allows the customer to enter more points than they have earned.
I don't know how I managed to miss that one in my earlier tests 
To fix the bug, change function get_points_redeeming in includes/modules/order_total/ot_reward_points.php to:
Code:
function get_points_redeeming()
{
if(MODULE_ORDER_TOTAL_REWARD_POINTS_TYPE=="Automatic")
$points_redeeming=GetCustomersRewardPoints($_SESSION['customer_id']);
else
if(isset($_POST['redeem_points']))
$points_redeeming=$_POST['redeem_points'];
else
$points_redeeming=$_SESSION['redeem_points'];
$order_total=$this->get_order_total();
$redeem_maximum=GetRewardPointsRedeemMaximum($order_total);
$points_earned=GetCustomersRewardPoints($_SESSION['customer_id']);
if($points_redeeming>$points_earned)
$points_redeeming=$points_earned;
if($points_redeeming>$redeem_maximum)
$points_redeeming=$redeem_maximum;
return $points_redeeming;
}
The section in red is the new code
Bookmarks