We just got a direct email message to the forum. (obvious spam). The strange thing is that the date of the PM is 11 days ago:
However the staged user is dated as created today (“Joined 4 Hours”):
Any idea what is going on?
I’m hoping that Discourse is not allowing spammers to back date messages. The official date for the message should be the date it is created.
We use the incoming email’s Date header to date the post, while the staged user is created when the email is processed. An email dated 11 days ago but processed today could explain this mismatch (could..).
We cap future dates at the current time, but preserve older dates. So yes, the sender can supply an older date, though we’d need to check this email’s headers to confirm what happened here.
Could you check the original email’s Date and Received headers? That should help distinguish an older sender-supplied date from delayed delivery. You should be able to click the 
button to see quite a bit of details.
I think this is what you are asking for:
Received: from vps.f3host.com (vps.f3host.com [xxxxxxx])
by discourse-mail-receiver.localdomain (Postfix) with ESMTPS id xxxxxxxxxxxxx
for <support@ourdomain.net>; Thu, 17 Sep 2026 22:21:39 +0000 (UTC)
...
Date: Mon, 7 Sep 2026 01:01:36 +0100
So it was received today but the date is 11 days ago.
I don’t see any benefit to the interface showing the date that the sender put in the header. Since direct emails are often spam, it feels like they should be given very little control over things. Spoofing a date feels like it could only be malicious.
Since you already prevent future dates, is there a reason we couldn’t just put the creation date for the post as the date that the post is actually created?