Is there something we have misconfigured about the spam flagging that would cause this?
Also, whenever there is a post flagged by the system, we have to process the flag and also the moderator inbox message. Is there a way to avoid having to do two things for every flag?
So, while I wasn’t able to fully reproduce this behavior, likely due to a spam-check job that runs at a certain time, here is what I believe happened:
The site setting newuser_spam_host_threshold is defaulted to 3. The description of this setting is:
How many times a new user can post a link to the same host within their newuser_spam_host_threshold posts before being considered spam.
When digging into the code a little, it looks like this does not apply to PMs, so it does not appear that the tutorial itself would trigger the flagging.
At 9:41am the System user flagged 4 posts at once for the user in question. Each flag had the same message:
This new user tried to create multiple posts with links to the same domain (<link>). See the newuser_spam_host_threshold site setting.
Between the first two flagged posts (non-tutorial posts), a link to the same host appears 3 times, thus hitting the threshold.
The other two flags listed are from the discobot tutorial, but are referring to the naturally posted links (wikipedia and image) and have not met the threshold under this user.
Main Suspicion: When a user breaks the spam host threshold, ALL posts (including PMs) where they have included links are included to make sure they are dealt with if they are confirmed a spammer.
So technically speaking, I think it’s doing what was intended. It looks like you’ve configured white_listed_spam_host_domains with some common hosts, but if you keep getting false-positives, you could try raising the newuser_spam_host_threshold sightly and bring it back down if there are any issues.
Your main suspicion sounds correct to me. Thanks for pointing out those settings, I just discovered white_listed_spam_host_domains today, so setting that should help a lot!