Looking at the message id, this came in through email. I have now
trained this as spam in spambayes (which unfortunately also means that
user:5 gets associated with being spam; we'll have to watch this and
train potential other misclassifications also).

It was a lucky shot of the spambot to guess a valid email address when
sending to the report address. To make this really safe, I can't think
of anything else but require PGP signing of messages (but this really
belongs to tracker-discuss).