This could be used to spam admins, without them having any way to stop it, and as tobba has informed me, isbanned() is called before byond does much validation on the data (like checking that the claimed username exist or validating that they own it), leaving these notices vulnerable to html injection