Today, [these](https://superuser.com/a/1282477/442468) [two](https://superuser.com/a/1282692/442468) posts were 'vandalized' by their author. This got picked up by the [SmokeDetector bot](https://charcoal-se.org/#whats-smokey), and as I attempted to roll them back to their original state, I noticed they both had (probably pirated) serial keys hidden in HTML comments. This is easiest to see in the Markdown source of the revisions: [1](https://superuser.com/revisions/46df93ae-13bf-41e2-8679-8af4cf17c641/view-source), [2](https://superuser.com/revisions/a2dc6079-2f24-4929-b222-e090fbf5c81a/view-source).

Later, the user surprised me by posting a [question](https://superuser.com/questions/1283113/free-license-keys-see-description) (10k only) promoting their act; it contained a direct link to one of the revisions.

I flagged the latter question as spam, and it seems to have had effect. I flagged the other posts for moderator attention; they have the power to [redact revisions](https://meta.stackexchange.com/q/191121/295232) which will effectively banish the content from Super User.

Is this the correct action, or should I have done something else?