This is a revisit for https://jira.atlassian.com/browse/JRASERVER-11926

When an old user is deactivated or deleted and a new one is created, they see the old user's data as their own.

This is currently by design, as we can see in Configuring user directories:

In some situations, reordering the directories will change the directory that the current user comes from, if a user with the same username happens to exist in both. This behavior can be used in some cases to create a copy of the existing configuration, move it to the top, then remove the old one. Note, however, that duplicate usernames are not a supported configuration.

Even though confusing at times, this behavior is also useful on directory migrations.

For deleted users, there could be something like a job that renames them internally to "<username>_deleted" to prevent this from happening - or a mechanism for admins to perform this user distinction.