This can happen. All a deactivated user needs to do to re-activate their account is to attempt to login to the site, then click the link in the activation email that’s sent to them.
When a deactivated user attempts to login they will see this modal:
Discourse will send them a “Confirm your new account” email:
After clicking the link in the email, the user will be logged into Discourse.
This has been the behavior for as long as I can remember. I don’t think it’s a bug, but I could be wrong about that. Sending a “Confirm your new account” email to a user who already has an account seems a little off.
Edit: to get the behavior you are looking for, you probably want to “suspend” the user instead of deactivating them.