The Private Topics plugin was installed.
Two things were going on:
- all topics were somehow created by the
support_staffgroup and not by the individual users - the setting “Private topics permitted groups” (Always show topics started by a member of these groups) included that
support_staffgroup.
Hence, all topics were visible for all TL0 users.
When support_staff was removed from “Private topics permitted groups” everything worked as intended.