Possible violations of global rights policy (last month)

This query looks for actions in the last month that should have been impossible, ignoring global groups. Many of these actions, therefore, are likely to violate the global rights policy of the English Wikipedia

Global false positives: staff, users who lost relevant user groups
Result set 1; Moves without redirect by users who shouldn't be able to do that. 
Known false positives: Known false positives: global rollbackers/stewards legitimately reverting page-move vandalism, moves in content models that don't support redirects.
----
Result set 2: Other admin actions by non-admins. Known false positives: Stewards doing bigdeletes
----
Result sets 3-6: Edits through non-semi protection that should have been impossible. 
----
Result set 7: Violations of account creation rate limit 
This query is not intended to be exhaustive list, and there are many ways for the global rights policy to be violated without triggering this list.
A perfect query is literally impossible, as it cannot catch, ex., stewards viewing oversighted content, which is technically a violation but leaves no traces behind.

SQL

/* Moves by non-autoconfirmed  */
use enwiki_p;
select log_id, log_type, log_action, user_name, user_editcount, user_registration from logging
join actor on actor_id = log_actor join user on user_id=actor_user where log_type="move" 
and (user_editcount < 10 || user_registration > (DATE_FORMAT((NOW() - INTERVAL 4 DAY),'%Y%m%d%H%i%S'))) 
and not exists (select * from user_groups where ug_user=user_id and ug_group="confirmed")
and log_timestamp > "20190501010101" limit 100;
/* Moves without redirect */
select log_id, log_type, log_action, user_name, user_editcount, user_registration from logging
join actor on actor_id = log_actor join user on user_id=actor_user where log_type="move" and log_params like '%"5::noredir";s:1:"1%'
and log_timestamp > "20190501010101" 
and not exists (select * from user_groups where ug_user = actor_user and (ug_group="extendedmover" || ug_group="sysop" || ug_group="bot"))

SQL

Checking query status...