# Spam from "system"
**URL:** https://meta.discourse.org/t/spam-from-system/386364
**Category:** Bug
**Tags:** spam
**Created:** [October 21, 2025, 8:05pm UTC](https://meta.discourse.org/t/spam-from-system/386364 "2025-10-21T20:05:06Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Mark\_W\_Bennett](https://meta.discourse.org/u/Mark_W_Bennett)
#### Post date: [October 21, 2025, 8:05pm UTC](https://meta.discourse.org/t/spam-from-system/386364/1 "2025-10-21T20:05:06Z")
On our Discourse instance, the “system” account has started sending spam to the forum and the email list. It has happened three times in the last five days.
There is no user responsible for “system,” nobody has logged in to admin with that username, and there are no obvious attack surfaces in the admin panel.
My best guess is that someone is exploiting the discourse server. So I came here figuring someone would have seen this before, but I’m at a loss.
Any thoughts?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [October 21, 2025, 8:14pm UTC](https://meta.discourse.org/t/spam-from-system/386364/2 "2025-10-21T20:14:11Z")
What does this spam look like?
It’s hard to think of how that could happen.
---
### Author:  [@Mark\_W\_Bennett](https://meta.discourse.org/u/Mark_W_Bennett)
#### Post date: [October 21, 2025, 8:35pm UTC](https://meta.discourse.org/t/spam-from-system/386364/3 "2025-10-21T20:35:05Z")
Two things:
1. “W-8BEN compliance.”
2. Chinese shipping (?) spam.
This just popped up after “system” had been quiet for six years.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 21, 2025, 8:43pm UTC](https://meta.discourse.org/t/spam-from-system/386364/4 "2025-10-21T20:43:41Z")
Do you have any active API keys? Check `/admin/api/keys`
---
### Author:  [@Mark\_W\_Bennett](https://meta.discourse.org/u/Mark_W_Bennett)
#### Post date: [October 21, 2025, 9:39pm UTC](https://meta.discourse.org/t/spam-from-system/386364/5 "2025-10-21T21:39:58Z")
We don’t.
(I walked through this with an LLM, and that was one of its suggestions.)
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 21, 2025, 9:57pm UTC](https://meta.discourse.org/t/spam-from-system/386364/6 "2025-10-21T21:57:37Z")
Does `/u/system/preferences/security` show any recent browsers ?
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [October 21, 2025, 10:02pm UTC](https://meta.discourse.org/t/spam-from-system/386364/7 "2025-10-21T22:02:15Z")
I remember reading another topic where someone reported spam posts that were authored by the system. But I cannot find it anymore. I think the topic was deleted.
---
### Author:  [@Mark\_W\_Bennett](https://meta.discourse.org/u/Mark_W_Bennett)
#### Post date: [October 21, 2025, 10:15pm UTC](https://meta.discourse.org/t/spam-from-system/386364/9 "2025-10-21T22:15:22Z")
No, `/u/system/preferences/security` does not show any recent browsers (“recently used devices,” right?).
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 21, 2025, 11:38pm UTC](https://meta.discourse.org/t/spam-from-system/386364/10 "2025-10-21T23:38:50Z")
Looks like this was caused by a bad change on our side. Sites that have both:
- Staged users disabled
- Allow incoming emails
Will get incoming emails under the system user.
The team responsible is working on a fix.
---
### Author:  [@lindsey](https://meta.discourse.org/u/lindsey)
#### Post date: [December 5, 2025, 2:27pm UTC](https://meta.discourse.org/t/spam-from-system/386364/12 "2025-12-05T14:27:42Z")
Sorry for the delay on our response — we fixed this issue back in October so this shouldn’t be happening anymore. If you notice any issues, though, please let us know!
---
### Author:  [@lindsey](https://meta.discourse.org/u/lindsey)
#### Post date: [December 8, 2025, 1:00pm UTC](https://meta.discourse.org/t/spam-from-system/386364/14 "2025-12-08T13:00:52Z")
This topic was automatically closed after 2 days. New replies are no longer allowed.