Another thing with the can_invite_to, users with TL below the SiteSetting.min_trust_to_send_messages can circumvent creating new PMs by inviting users to PMs created by system (and possibly discobot) when PMs are enabled.
Yes, our users are a creative bunch. 
Example repro (I’ve verified this works on our forum):
- Have private messages enabled
- Have
SiteSetting.min_trust_to_send_messages= TL4 - Create user with TL2
- Go to /u/:username/activity
- Click
Download Allbutton - @system will message you with a download link
- Notice there’s a “Invite others…” button in message
- Invite another user to message