So, while I wasn’t able to fully reproduce this behavior, likely due to a spam-check job that runs at a certain time, here is what I believe happened:
The site setting
newuser_spam_host_threshold is defaulted to 3. The description of this setting is:
How many times a new user can post a link to the same host within their
newuser_spam_host_threshold posts before being considered spam.
When digging into the code a little, it looks like this does not apply to PMs, so it does not appear that the tutorial itself would trigger the flagging.
At 9:41am the System user flagged 4 posts at once for the user in question. Each flag had the same message:
This new user tried to create multiple posts with links to the same domain (
<link>). See the newuser_spam_host_threshold site setting.
Between the first two flagged posts (non-tutorial posts), a link to the same host appears 3 times, thus hitting the threshold.
The other two flags listed are from the discobot tutorial, but are referring to the naturally posted links (wikipedia and image) and have not met the threshold under this user.
Main Suspicion: When a user breaks the spam host threshold, ALL posts (including PMs) where they have included links are included to make sure they are dealt with if they are confirmed a spammer.
So technically speaking, I think it’s doing what was intended. It looks like you’ve configured
white_listed_spam_host_domains with some common hosts, but if you keep getting false-positives, you could try raising the
newuser_spam_host_threshold sightly and bring it back down if there are any issues.
Let me know if you need any more information.