When org.jivesoftware.openfire.muc.MultiUserChatManager#userDeleting is invoked, the user that's being deleted is removed from the MUC room configuration that's persisted in the database. It should also be removed from in-memory data. There is potential room for abuse here: a new user could be created, and re-use any privileges of a room that the old user (of the same name) had.