When you are looking at someone else's code, at what point can you definitively know it is bad code?  I'm sure everyone has their metrics.  Here's mine and so simple too:

Server Timeouts

Yep, real simple.  Here's the thing:  Nothing else, in my mind, shows a greater lack of understanding of the basic architecture of a system than poorly set timeouts.  For instance.  while not a bad idea to adjust the timeout of the SQL connection to fit what you are doing, setting it to 1200 means you don't realize that it means seconds and you just told your application to wait 20 minutes before doing any damage control.  I don't know about you, but ANY application that makes me wait 20 minutes for anything (without showing me real progress) is broken; I am impatient after 20 seconds!  Another example:  setting an ASP.NET app to use a session timeout of 300 minutes means you don't care about your server at all.  Why not store user specific information (full DATASETS!) in memory for 5 hours after the user has left the page.  5 hours!

These are real examples of code I am working on today.  I don't care how elegant your architecture is, Server Timeout abuse has always been a very simple indicator of developer incompetance.  Oh, and it seems to be in direct proportion of scale too.  I have actually seen an ASP session set to 3000000.  Yes 3 MILLION minutes.  That is 50,000 hours.  5 years, 8 months, 14 days, 13+ hours.  Yeah, that'll work.  I was not well loved because I wouldn't allow crap like that to run on my servers.

BTW, 3M minutes was by the same coder who thought LastName is a good primary key on a DB.  And when that didn't work, how about a composite key on LastName, FirstName.  Yep, World Class programmer.