Lucas discovered that the Merge button had been reenbled, twice in the past couple weeks.
What happened was that the restriction on who could push was removed. I re-enabled the restriction both times, but it may be reverted again.
Indications are that it is probably mungegithub. People are looking into it now, but if the Merge button is enabled for you and you don't think you have admin privileges, please report it ASAP. And don't click the button. :-)
Thanks.
--Brian