He made a bunch of those posts on /agatha2/ as well, I mistook them for normal spamming at the time. So this exploit only worked if user post deletion was enabled? I had it disabled and I haven't noticed any images missing, but I can't be sure.