@cryptoethic

Ok so most queries comes from line 90:

@cryptoethic I have banned the particular user and no more sessions are created.

I suggest adding method revokeSessionsAboveTreshold that removes oldest sessions above treshold.

	User.auth.addSession = async function (uid, sessionId) {
		if (!(parseInt(uid, 10) > 0)) {
			return;
		}
		await cleanExpiredSessions(uid);
                await revokeSessionsAboveTreshold(meta.config.maxUserSessions);
		await db.sortedSetAdd('uid:' + uid + ':sessions', Date.now(), sessionId);
	};

I can add such a function and add PR to core. What do you think?