A long-standing member suddenly posts the same link in ten channels. It's almost never them. Their account has been taken over, and the right response is different from handling a spammer.
In the first five minutes
- Delete the messages. Search the member's name in the server to find them all.
- Time them out instead of banning. A timeout stops the spam and keeps the member's history and roles.
- Reach the member somewhere else: a friend, another server, or email. The hacked account's DMs aren't safe.
- Check the log for what else the account did, such as a role change or an invite posted.
How to tell it from a real spammer
A hacked account has history: it joined weeks or years ago, it chatted normally, and then it changed overnight. A spammer who joined an hour ago has none. Same link, very different handling.
What Sift does automatically
When the same link lands across channels in a short window, Sift removes the copies and flags the case as a likely hacked account. The case card has a Hacked account button. It clears the strikes without penalizing the member and sends the server owner a short note about securing the account. No removal DM goes out saying they broke a rule, because they didn't.
Getting the member back
Once they've changed their password and logged out of other sessions, lift the timeout. If you did ban by mistake, Sift's appeal flow sends a one-time invite and opens a private ticket channel with your mods.