Users can continue creating local accounts with abusive names after they've been locked and hidden (but not oversighted). This was introduced in the recent 1.16wmf4, and is being exploited by vandals to propagate attack usernames crosswiki.
Version: unspecified
Severity: blocker