What if duplicate accounts are created for not-so-serious crimes like bumping? https://wordpress.org/support/topic/change-path-to-sign-uplogin?replies=1&view=all#post-5357479 I don't think that's why the account was created to begin with, but it's clearly being used to bump. Would you block the duplicate or just leave?