I see, thanks for the advice. It does appear that I’ve changed the default settings on the one called “direct message enabled groups” and opened messages for everyone.
Allow users within these groups to create user-to-user Personal Chats. Note: staff can always create Personal Chats, and users will be able to reply to Personal Chats initiated by users who have permission to create them.
This seems like a heavy-handed approach for my situation (which is why I probably changed it in the first place). I think it block way more false positive situations than the one I’m worried about.
I think making all deals public is also a smart choice but I have a feeling it will not be a compatible approach with the culture of the community I’m working within. In our case, people are making public offers to buy things and this scammer has taken advantage of that knowledge to solicit those individuals to say they have what they are looking for. I think people really value doing the negotiations privately though.
Thanks again for the suggestions. If it really becomes a common problem I’ll set that setting back to default or work on a warning theme component like I described.