I thought I had reported it, but maybe not. I couldn't find it.
I was just looking at the code and the fix would be somewhat tricky.
The logical place for it, imo, is in the save() function of the modUser object. It would involve code like I suggested above to check the DB, and would fire both OnBeforeUserActivate and OnUserActivate. But then the confirmRegister snippet in the Login extra would have to be modified to remove the invocation. Until people updated the Login package, for example, whatever happened in a plugin tied to OnUserActivate would execute twice.
My ActivationEmail extra, and perhaps other extras, would also have to be modified.
Another place for it would be the user/create processor, but then it wouldn't be invoked by lots of code that calls save() directly when creating a user instead of using the processor, so I think that's off the table.
Besides confirmRegister, the only place I could find where that event is invoked is in the activatemultiple processor, so the invocation would have to be removed there as well, but that processor uses the response to determine whether the user can be activated or not. I don't think that code is used by anyone, but I could be wrong.
You can report it here:
https://github.com/modxcms/revolution/issues