When a username is hidden in the results list in Special:CheckUser, the CheckUser summary table treats the text that is shown instead of the username (i.e. username removed) as a valid username and therefore provides a wikitext link for it.
Example:
Steps to replicate the issue
- Create a new user account
- Login to a user account with the suppressor and sysop group
- Block the user with hideuser enabled
- Login to an account which does not have the suppressor group
- Run Special:CheckUser where the target of the check the IP used by the user you blocked in step 3
What happens?:
The CheckUser summary table (the one shown in underneath See results in a table) has a row for username removed where the text is clickable.
What should have happened instead?:
The row should be there, but it should not have a link to avoid confusion.