I ran into something today while handling a flagged post and wanted to confirm expected behavior.
A post was auto-flagged by Discourse AI as spam. The content was clearly unrelated to the forum (non-English, off-topic, softcore-type content), so I agreed with the flag, deleted the account, and selected the option to block the user IP.
Shortly after, I noticed in the email logs that an email was sent with the type account_deleted.
This raised a concern.
Is it standard behavior for Discourse to send an account deletion email in cases like this, including obvious spam accounts?
If so, is there a way to disable this specifically for spam-related deletions?
From a moderation perspective, it seems counterproductive to notify spammers that their account was removed. In cases where the spam is blatant and confirmed via flags, it would be preferable for the action to be silent.
I also want to rule out the possibility that I’m misinterpreting the logs or associating the wrong email with the deletion.
Looking for clarification on:
Whether this notification is expected behavior
If it can be disabled or adjusted for spam workflows
Nope, not really at the moment I don’t think. I actually quite like the notification and think it’s a good feature but there is something to be said about notifying spammers and the impact it might have because then can’t they just remake an account? Also, if I were really a good faith user, would I really be getting picked up by the spam detector and banned by an admin?
Just deleted an account posting AI slop from a new account that shares the same IP as 2 other accounts. Not happy when they get this heads up email:
Hello,
This is an automated message from X to let you know that the user account associated with this email address has been deleted by a staff member.
Your post was flagged for approval: it has been automatically queued for review by a staff member to ensure it meets our community guidelines.
Please review our community guidelines for details.
Would really like to disable those from going out. Forum search brought me here.
I think deleting from the (admin) profile page instead of the review queue still works as a workaround. But I know it’s not as comfortable as doing it directly in the review queue
I suspected there might be some compliance rational for doing this.
It reminds me of the ‘old days’ of administering an email server. I recall at one point (decades ago) I was having a reverse failed delivery notification attack from spammers. They would spoof the sender’s address and then send the email to a non-existent account on my server. At the time to comply with standard SMTP protocol a failed delivery had to be sent a notification of delivery failure, including a copy of the failed email. The intended target of the spam was the spoofed sender’s address and they would receive the delivery failure notification… including the actual email.
Although I suspect the spammers in question in this particular instance are automated and no human will ever see the account deletion email it occurs to me that we are providing the spammers with more information then necessary which then may be used to fine tune their tatics.
Error since I quoted him. Fixed.