kicks can maliciously change display name and avatar

if you kick someone you can apparently override their profile at the same time

Start by locating the Matrix specification sections that define kicking a user and changing display names or avatars. Confirm how a kick could override those profile fields, then clarify the intended protocol behavior before changing the relevant specification text. Done means the malicious interaction is prevented or explicitly constrained by the spec.

Written by the indexing model from the issue text.