When the posts of a malicious user are deleted in bulk, each comment that is removed is replaced with “removed by mod”. This implies that the mod of that particular community removed that particular comment. The modlog of that channel does not account for the removal, so there is no traceability or way for users to check whether they have an overly ambitious mod.

When a bulk removal is performed, the replaced comment should be more transparent. It should say “comment removed in bulk cleanup of malicious user’s content” and it should link to whatever modlog might capture it.