This issue still prevails in Xenforo, but I worked around it by using a conditional in the message template that only displays signatures if they are from a particular user group.
Today I found another user permission with registered members that used to pay for a premium membership. The member was able to send me a private message. The private messaging system is completely disabled for registered members, but the member was able to message me because they had previously upgraded their account.
However, despite downgrading their account, they can still use the private messaging system. This is despite the fact they belong to a user group that does not permit this.
What is causing this?
Clearly, member upgrades should not be active if the member downgrades. I have tested permissions using a test account and despite the test account not being eligible to send messages, the account is able to do so because they used to belong to a user group that allowed.