This seems to be about data that was imported when we migrated from vB to XF. I can't confirm either way whether it would apply equally to "new" data.
In both old and new systems, our Warnings and Warning Actions setup is/was/always has been such that when a user's point score passed a threshold, they were added or moved to a (restricted) UserGroup for a defined period. (We have never deployed the alternate method whereby a user's restrictions were in place while their points were over a threshold and reverted when the points reduced below it.)
So, in theory, there is NO action that should be triggered when, say, a Warning expires.
In addition, the Warning Actions are/always were to add or move users to restricted groups short of a full ban. No warning action ever triggered a full ban. Full bans were always manually applied (or via the Spam tool).
In XF our fully banned users are both flagged "Banned" and in a secondary UserGroup (= Banned) with practically no permissions.
I did a search and found several users who were without the "Banned" flag but who were in the Banned usergroup. (So, no risk; but no user should be in this state).
I checked notes and these should have been fully banned PERMANENTLY some time ago. No scheduled expiry.
I checked the Change History in the AdminCP and I see that the banned flag was recently lifted. The change tab reports this as having been done by the user himself, which I suppose really represents a system action of some sort.
Comparing the timestamp of this unscheduled action, I see that it coincides with the expiry of a Warning.
So I guess that, somehow, the expiry of the warning is causing the Banned flag to be lifted. This should not, of course, be happening.