Lets say you delete a spam user, e.g. /xwiki/bin/view/XWiki/xanax via the administration tools. You then log out as admin. Now, as an unregistered user, browse /xwiki/bin/view/XWiki/xanax You'll be given a link to 'Restore' the deleted file e.g. /xwiki/bin/undelete/XWiki/xanax?id=47 When an unregistered user clicks 'Restore' the file is restored (!! bug !!). Fortunately if the "restored" account is used for login, the user can't view or edit any files. IMHO there ought to be an additional option on deleting users which will also remove the account from the recyclebin or not recycle accounts. Unfortunately, if there's a file you wanted deleted, apparently an unregistered user will be able to find out it was there (say, through a search engine), and restore it if they want to. This is on 1.8RC2. Niels http://nielsmayer.com PS: quick and dirty solution -- set "xwiki.recyclebin=0"