Recently an Anonymous placed a comment into an issue, while Add Comments permissions is reduced to only project roles. The comment itself is not visible.

Also Anonymous added attachment, it is still there. Permissions is available to specific project roles also.

Does anybody know how can this happen?