They changed the activation url. That’s the problem. Your isset( $_GET[‘key’] ) fails so the message isn’t injected.
Refactor member activation URL to better avoid email spam filters. New URL looks like this – example.com/activate/XXX. The older URL format – example.com/activate/?key=XXX – is still supported for backward compatibility. (#5831)
That’s what I thought to. I’m just waiting for a spare moment to dig into it.
Yes. That’s the one. Its also used in the profiles when they try to access bbpress or bp. Its showing up in those cases. Just not when the user activates the account.