Prerequisite: Moodle Account A has the capability moodle/user:viewdetails on system level. I can think of moodle installations where this capability is set for all authenticated users for some reason. Moodle Account B was a moodle user, but his account was deleted by an admin several weeks ago.
Now, with Moodle Account A logged in, I visit
(I don't need to know necessarily the user ID of Account B, I can simply iterate the id parameter from 1 to n)
The profile of the deleted user shows with no details, but with full name - although the user account no longer exists!
When viewing the same page as admin, I get the message "This user account has been deleted".
I know that moodle saves some data from deleted user accounts. But I don't think that it is intended that this data is visible to non-admins, especially without any remark that this account no longer exists.
Furthermore, is that data from deleted users fully deleted by cron job some time or is it saved forever?