I’ve got the same issue with a BuddyPress/bbPress installation with private groups that have private forums. Forum search searches ALL the forums, whether they’re private or not and whether the user should be able to see that forum.
I deactivated forum search from WP Admin (Settings > Forums > Allow forum wide search) until there’s a way to close this security hole.
There’s actually some information on the updates that need to be made to the Post by Email plugin here: https://wordpress.org/support/topic/working-with-newer-wp-releases/
I’d be very happy if maintenance of this plugin resumed somewhere. I’m working on migrating an email group to bbPress and this is a core functionality the users don’t want to lose.
