peopleinside I'm not exactly sure how we ended up here and whether this was intentional from the start, but the current implementation is clearly made with no restrictions around login, logout or password resets for suspended users. We will soon make some changes to the permissions during which we might make it easier for extensions to customize this.
At the moment there's also no mechanism designed to stop email sending for some groups of users. We would first need to design something before extension could start interacting with the email ability.
This would need to be split across many issues, so it would probably be best we have an internal discussion about this stuff and create appropriate issues based on that.
A related issue I have noticed is that the current system doesn't prevent sending emails to users who have not yet confirmed their address. If they register and follow a discussion, they will start receiving notifications even if they have not validated their email yet. This needs to be handled in a broader email control system.
