A) Is it legal for a broker to monitor that their customer is about to place a large size order (i.e. it was to sell 4k shares at a 500 share bid), and to quickly sell the 500 shares themselves instead of the customer? B) Possiblity 2: the bid of 500 shares was on ARCA, the broker sent his sell order on CINN, and maybe it wasn't the broker, but some other party--but either way, something not handled well by the broker.
Massive front running going on in LEH today, could have been the seller but whoever it was wasn't trying to be subtle.