The sender controls the content of the membership event, since the
content contains profile data (display names, avatar urls) a sender
might incorrectly change the profile of another member inside the room.
This is allowed in the case where the sender is kicking or inviting the
member, this it will self heal once the member re-joins. Still, to
mitigate this a bit we're storing the profile data when we know that the
member sent out the content on their own.
Damir Jelić