It's not so much relevant in my opinion, but I think it's a bug. Try yourselves:
1. Set the mail validation to new users to true/yes;
2. Register a new user "test007", for example;
3. Lock this user "test007";
4. Click the link sent at test007's e-mail;
5. The user "test007" will be activated AND logged in the JForum!!!
6. Try to post any message while logged in with "test007": you will do it!!!
7. Logout and try login again: now, correctly, you won't do it;
(Of course you will have to change between the admin and test007 users to follow the above procedure.)
Maybe some verification when the user will activate its account, checking if its account is or isn't blocked, would be the solution, I think so...
PS: If somebody have a tip of what is the way to do it, maybe I can implement it ;) [originally posted on jforum.net by leandro_salvador]