Too ownable

It's too easy to give clues.

Firstly, there is no check on the entered address to. Second, the admin can send money on behalf of another user. Thirdly, with _data admin can do execution of functions in other users' contracts, if any. Well, and the banal absence of payable modifier. In other words, the function will always revert if msg.value > 0.