Today, these two posts were 'vandalized' by their author. This got picked up by the SmokeDetector bot, and as I attempted to roll them back to their original state, I noticed they both had (probably pirated) serial keys hidden in HTML comments. This is easiest to see in the Markdown source of the revisions: 1, 2.

Later, the user surprised me by posting a question (10k only) promoting their act; it contained a direct link to one of the revisions.

I flagged the latter question as spam, and it seems to have had effect. I flagged the other posts for moderator attention; they have the power to redact revisions which will effectively banish the content from Super User.

Is this the correct action, or should I have done something else?