-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
None
-
None
I had created a test account for some forms in beta, and set it to use my email address. On deleting the test account, Discourse set my non-test, reosarevok account as deleted.
While we currently block reusing emails in most cases (the email won't get a verification link if it's already verified for a different account), there's legitimate cases where an email can be shared between several accounts:
1) The accounts are grandfathered in - email addresses already reused before we started blocking reuse have not changed. We have almost 30k such addresses, including one (spammy) case with 176 accounts. Some are actually legit though (including some of mine ).
2) The accounts are bots that have had an admin set the same email address for them on the request of the bot operator.
In either of these cases, deleting an account could have unexpected results on Discourse.
We should either ensure that accounts are only deleted when they also match the deleted username, or if that is not possible just skip deleting accounts if one MB account of the same email still exists.