That’s this issue Invitation can cause users to be erroneously and transparently added to private message · Advisory · discourse/discourse · GitHub
It has been addressed in version 2.9.0 beta 12 which has been released earlier today, so upgrading would resolve this. The update also contains code that removes the users from the PM’s again.