Looks like it has been fixed. It was an Elgg bug. Should be out with 1.8.4
https://github.com/Elgg/Elgg/blob/1b15e9f33013cc5407ff7620989a3bb027348c41/engine/lib/users.php
info@elgg.org
Security issues should be reported to security@elgg.org!
©2014 the Elgg Foundation
Elgg is a registered trademark of Thematic Networks.
Cover image by Raül Utrera is used under Creative Commons license.
Icons by Flaticon and FontAwesome.