FEATURE: cap number of staged users (defaults to 10) created per incoming email

lib/email/receiver.rb

@@ -31,6 +31,7 @@ module Email
 
     def initialize(mail_string)
       raise EmptyEmailError if mail_string.blank?
+      @staged_users_created = 0
       @raw_email = mail_string
       @mail = Mail.new(@raw_email)
       @message_id = @mail.message_id.presence || Digest::MD5.hexdigest(mail_string)
@@ -283,6 +284,7 @@ module Email
               name: display_name.presence || User.suggest_name(email),
               staged: true
             )
+            @staged_users_created += 1
           end
         rescue
           user = nil
@@ -477,6 +479,11 @@ module Email
                   topic.topic_allowed_users.create!(user_id: user.id)
                   topic.add_small_action(sender, "invited_user", user.username)
                 end
+                # cap number of staged users created per email
+                if @staged_users_created > SiteSetting.maximum_staged_users_per_email
+                  topic.add_moderator_post(sender, I18n.t("emails.incoming.maximum_staged_user_per_email_reached"))
+                  return
+                end
               end
             rescue ActiveRecord::RecordInvalid
               # don't care if user already allowed