1. In the canDeletePost() method (line 575), the Thread Model is fetched directly from the cache, instead of being called via _getThreadModel(). Which makes it hard for an inheriting class to easily change the model being returned by overriding _getThreadModel.
return $this->getModelFromCache('XenForo_Model_Thread')->canDeleteThread( $thread, $forum, $deleteType, $errorPhraseKey, $nodePermissions, $viewingUser );
2. Same with the User Model, in canViewIps() method (line 740).
return $this->getModelFromCache('XenForo_Model_User')->canViewIps($errorPhraseKey, $viewingUser);