I encountered a very annoying spam user, which I blocked in pagure using pagure-admin block-user and disabled in FAS, but the pagure session was still active and the user was still posting comments.

It would be nice to have a way to invalidate an user active session. Best if that would be done as part of block-user or sanitize-spam-user in pagure-admin cli.

That should actually be already the case via:
https://pagure.io/pagure/blob/master/f/pagure/flask_app.py#_341

We found out that in this case the replies were probably done by responding to e-mail notifications from pagure.io. I'm not sure how those are different from just posting comment, but I needed to clean another bunch of the comments created around 0200 UTC today. Which is a half a day after the user was blocked.

We found out that in this case the replies were probably done by responding to e-mail notifications from pagure.io. I'm not sure how those are different from just posting comment, but I needed to clean another bunch of the comments created around 0200 UTC today. Which is a half a day after the user was blocked.

That is done in the milter:
https://pagure.io/pagure/blob/master/f/pagure-milters/comment_email_milter.py
and indeed that doesn't check for blocked user

Should be straight forward to implement around line 192 once the user object is
retrieved from the DB