Push notifications are being sent to deactivated users

Description:

We had an employee notify us that they were still receiving push notifications on their mobile device from our RocketChat installation. This was surprising to us because their RocketChat account had been deactivated. I tested this in our staging environment and was able to reproduce the issue.

Server Setup Information:

• Version of Rocket.Chat Server: 0.62.1
• Operating System: Ubuntu 16.04
• Deployment Method(snap/docker/tar/etc): TAR
• Number of Running Instances: 3
• DB Replicaset Oplog: Enabled
• Node Version: 8.9.4
• mongoDB Version: 3.4.13

Steps to Reproduce:

1. Create a secondary RocketChat account.
2. Login using the secondary account on the RocketChat mobile app. I tested this on Android.
3. Mention the secondary user in a room (using the @user syntax).
4. Deactivate the secondary account from the administrative panel.
5. Mention the secondary user in a room again.

Expected behavior:

Mobile device does not receive a push notification.

Actual behavior:

Mobile device does receive a push notification. Upon clicking on the notification, a login screen is shown (which is expected) and no further push notifications are received.

No files or tests are named. Start by reproducing the deactivated-account scenario described in the issue, then trace the push-notification path and its account-status checks. Done means a deactivated user receives no push notification when mentioned, while active users continue to receive notifications.