The request subscriber should properly check admin paths and user roles before executing the spam prevention checks:
Subscribing to the http_middleware is too soon as current_user service & request routing context is not fully loaded.
Replacing it with a regular request subscriber solves this issue.
Needs work
9.1
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.