Verified the patch locally. Problem prevented.

This is likely to be caused by the way a nickname is represented in the MUCRole descendants.

LocalMUC user creates a (local) MUCRole like this:

While RemoteMUCRole gets its nickname from an event, that specifies the value like this:

Notice that one implementation trims the resource, while the other one doesn't.

This behavior corresponds with what we see on our domain: malicious users are flooding MUC rooms with nicknames that never get cleaned up (not even after the client disconnects).