Allow a deleted account to be recovered by a password reset

[tomhughes]

I'm not totally sure if this is a good idea, but we get a reasonable number of people contacting support because they're unable to open an account because they have a previously deleted account that is using the email address.

Usually they've tried to signup, been told the address is taken, and then tried to do a password reset which rails because we don't allow a reset on a deleted account.

So this PR makes it work by allowing a reset on a deleted account, and then undeleting it if the reset is completed.

Because historically we used "soft deletes" on spam accounts we have a large number of historic spam accounts in status deleted that we don't really want people to reopen so this attempts to convert them to suspended which is how we now handle spam accounts - it does that by looking deleted accounts that still have their original username.

[gravitystorm]

I'm not totally sure if this is a good idea

I don't think this is a good idea at all. If the account is closed, then that should be that - it's closed, and shouldn't be resurrected. If the user returns and wants an account again, then they can make a new one. There's a bunch of non-reversible stuff that happens when an account is closed. That's not even covering things that we should probably be removing from destroyed accounts (e.g. diary comments, private messages between destroyed users) since it's hard to argue for legitimate interest in keeping these in the db several years later.

It will be particularly surprising for anyone who deliberately closed their account, still remembers doing so, and then it turns out that the account and lots of personal data has been kept all along!

I think it's better to continue work on making account deletions work better, including removing email addresses, instead.

[tomhughes]

Well we're never going to be able to remove all email addresses so that's not a complete solution.

[gravitystorm]

Well we're never going to be able to remove all email addresses so that's not a complete solution.

But the ones we need to keep could be kept in a different column.

[hlfan]

I don't think that the sole criteria for allowing account recovery being whether it has been renamed is suitable since there have been enough spam accounts with custom names.