[Cthulhu_]

He confesses that it was a black hat "proof of concept", but he's refunded the money and reported things to Patreon.

Patreon, and ANY website that has user's profiles as permalinks, should reserve ANY account name that has been deleted to prevent squatting.

I'm not sure how this works with the right to be forgotten laws though; I have a gut feeling that you can have your profile deleted and the leftover URLs and permalinks just go to 404 or other kinds of placeholders.

[julianwachholz]

Wouldn't the proper status code be "410 Gone" in that case?

[harperlee]

Then you are leaking info about previous (or private) existence of the resource. If I recall correctly github does 404 for existing private repos, for example.