The WordList protection doesn't look up the username

The display name or MatrixID can give very clear information about the reason why an account is joining a room. The WordList protection only looks up in the message content, not in the MatrixID or display name

Locate the WordList protection implementation and its handling of room-join events. Start by tracing where message content is checked, then determine how the display name and MatrixID can be included in the lookup; done means matching those identity fields as well as message content.

Written by the indexing model from the issue text.