I discovered today that there is a loophole: When people get muted, the server checks if the user account exists or not. It did so by looking for a website account. If the user however deleted their website account, this check failed, and the user could not be muted.
So what I did first was to make a fallback that looks for the userfile on the minecraft server in addition in case the website account does not exist. On top of that, I now added a process that removes people from the whitelist and boots them off the server as soon as they delete their account on the website. Thanks to Albertpuding helping me testing!
While we did not have this issue before, I think it’s an good process to have people removed from the server as soon as we do not have an email address on file for them anymore. It keeps the accountability for them up, at least a little :) and also stronger links what happens on the website with what happens on the server.