They definitely overstepped the rules. Code Adam is about stopping somebody from walking out with a kidnapped child -- they shouldn't be stopping people who don't have a kid. (If somebody does have a kid, they need to try to verify that the kid is with the correct adult; the smart way to do it is to have the missing child's parent at the exit to look at kids.)

But like most complex rules, your typical food service or retail employee probably hasn't been well-trained for a Code Adam. Check out this crazy thread from The Consumerist where a Wal-Mart security guard tried to "rescue" the wrong baby.