Thank you to the Zen Cart team and the other contributors for finding and fixing this issue.

Two questions, after installing the patch and running the SQL patch.

1. The spam customer records are not deleted. Just curious to know why? The leave an audit trail? Less risk to just disable the thread but not delete?
2. The clean up check page still reports spam accounts after running the patch. I still get the "80 statement(s) processed" message. Is that to be expected?