This has been fixed as part of SECURITY: Don't display user's old whispers if not in allowed group · discourse/discourse@0b1dd04 · GitHub.