I only remove a topic one every few days, so it's not a big deal for me. If the others have similar numbers then I don't think we need to up our security
"I advocate infinite effort on behalf of very finite goals, for example correcting this guy's grammar."
- David Frum
I've disabled the ability to add a do follow link in the profile.
I also removed a bunch of users that had never logged in, had zero posts, and have spammy email domains (like .ru). Unlikely that I got any legit users, but sorry if I did; there were thousands of them, most recent from our bot flood.
I also deactivated some similar users who signed up before the forum move and never logged in once and didn't have any posts.
Should I go ahead and delete users who registered more than six months ago, have never logged in, and have zero posts regardless of email address?
I don't really want to spam reminders (I don't think it's worth it when if a user rediscovers the forum, said user can just sign up again).