There are 2 functions responsible for confirming user email, UserEmail.confirmByCode and UserEmail.confirmByyUid https://github.com/NodeBB/NodeBB/blob/master/src/user/email.js#L180-L254.
When a user clicks the confirmation link in the email the first one is used. But there are other ways that can confirm the email via confirmByUid (for example an admin doing it from the ACP or a plugin directly confirming it by calling that function). I suggest checking if anything is calling confirmByUid other than the email -> confirm flow.