A user reported an amusing edge case where replying to a Discourse notification email caused the notification address itself to be added as a staged user. nathank explained that a user replied to a notification email that had been CC’d, using the site’s email-in address as the destination. Because the notification address (notifications@ourdiscoursesite.nz) was in the CC field, Discourse treated it as a new participant and created a staged user associated with that email. Although no harm was done, nathank suggested that outgoing system email addresses should be excluded from staged user creation.
RalphCockburn confirmed the mechanism, noting that incoming email processing treated the CC’d notification address like any other new address on the thread. While agreeing that this behavior is unintended, RalphCockburn advised suspending or anonymizing the resulting staged user to prevent accidental @mentions or private message invites. Both users agreed that the system should skip site-owned outgoing addresses when staging users to avoid this issue.
I found this one a bit amusing.
One of our users included an email-in email address (xxxx@ourdiscoursesite.nz) in a reply to one of our site’s notification emails (which was Cc’d).
This resulted in a staged user being created with the sender’s name and the notifications@ourdiscoursesite.nz being the associated email address.
While this is a bit weird, there was no harm done.
This shouldn’t be possible I don’t think - perhaps the system emails should be excluded from creating staged users?
Funny one. What I think happened: the reply hit your email-in address, and because the notification address was in the Cc, incoming email processing treated it like any other new address on the thread and staged a user for it.
No harm in the short term, but I’d suspend that staged user (or anonymize it) so nobody can @mention it or add it to a PM by accident. Agree that the site’s own outgoing addresses should be skipped by default when staging users.