We have a Wordpress site on a shared server that recently crashed due to running out of disk space, because our MySQL binary logs filled up the drive in a matter of minutes. After reviewing what was in them, we traced it down to a single user in this site that has ~3.4MB being stored in the
usermeta table with a meta key of
session_tokens. I clicked the Log Out Everywhere option for this user which deleted those records, but then today the same issue started occurring and all of his tokens are back.
Any ideas? I'm not really sure where to begin with this and have no idea how he's amassed this many tokens. I wrote a Wordpress scheduled task that is supposed to delete expired tickets hourly, but since his account had nothing and now today has thousands of them again, the expiration stuff must not apply. I took a peek at some of the expiration timestamps and they are all milliseconds apart, which confirms the scheduled task probably won't help.