I found this user who, by my confusion and surprise, has a badge for reviewing posts, "Custodian".
Custodian: Complete at least one review task. This badge is awarded once per review type
It says the user was awarded this badge On September 16 at 16:45. He has one post with -1 votes, and no answers. How could he have possibly been able to get the privilege to review?