I've just came across a new SO user (user13450655), who had only 1 reputation (at the time of writing the post), but already earned the Citizen Patrol badge.
The strange in that is Citizen Patrol is awarded when the user flags a post, but the Flag posts privilege requires 15 rep.
Also, that user has no reputation changes yet, which would have allowed them to flag a post.
So, my question is, how could they flag a post without the privilege or earn the badge without flagging a post?