From Dmitry Yemanov
Running GBAK -C by a non-privileged user (i.e. neither SYSDBA nor database owner) causes an original database to be overwritten instead of the expected “database already exists” message.
This bug seems to be inherited from IB 6.0 and it exists in all FB versions. However, FB 2.0 is not affected due to different default restore rules.