@pitaj That makes sense.
Thank you, I think that answers my question.
I was surprised to learn that registered users are allowed to post before they have verified or confirmed their email. To cut down on spurious postings, I think it'd be better to give site admin the option to allow/disallow posting before an email has been verified.
The only feature close to that in the ACP is on the Post tab of the General Settings page which ways that Allow guests to post without logging in. I think there should be one that says something like Allow registered users to post without confirming email
I'd guess it was some sort of bug, along with deleting an account of someone who is online which means they can carry on posting as a user with no username etc.
Is it a bug or is that the way NodeBB was coded to work?
@planner Definitely a bug.
The only difference between the two images is that I went into the ACP in another browser, deleted the Test.ing account, then refreshed the Test.ing browser. Even with allow guest posting turned off, I'm able to make new threads, reply to topics as if I were an actual member. Clicking Profile on the deleted account just refreshes whichever page you're currently on.
I seem to recall when we had the spam issues here that someone else noted similar behaviour.
Yep, I noticed that too after I deleted an accounted I created. User and access management sure need some more loving attention.