Or, not malicious at all, simply a bug. The 'delete user' functionality is going to be rarely used, so it gets hardly any QA test coverage, compared to the news

Or, not malicious at all, simply a bug. The 'delete user' functionality is going to be rarely used, so it gets hardly any QA test coverage, compared to the news feed page functionality used by many hundreds of millions of people.