I'm seeing some red flags here too. The sudden change of email, multiple wallet changes, inconsistent loan requests, and the fact that the user was told to sign a message with a new wallet that's never been seen on Ninjastic... It's like they're trying to cover their tracks. I'm curious, did you notice if the user's posting history has any other suspicious activity?