Possible violations of global rights policy (last month)

This query looks for actions in the last month that should have been impossible, ignoring global groups. Many of these actions, therefore, are likely to violate the global rights policy of the English Wikipedia

Global false positives: staff, users who lost relevant user groups
Result set 1; Moves without redirect by users who shouldn't be able to do that. 
Known false positives: Known false positives: global rollbackers/stewards legitimately reverting page-move vandalism, moves in content models that don't support redirects.
----
Result set 2: Other admin actions by non-admins. Known false positives: Stewards doing bigdeletes
----
Result sets 3-6: Edits through non-semi protection that should have been impossible. 
----
Result set 7: Violations of account creation rate limit 
This query is not intended to be exhaustive list, and there are many ways for the global rights policy to be violated without triggering this list.
A perfect query is literally impossible, as it cannot catch, ex., stewards viewing oversighted content, which is technically a violation but leaves no traces behind.

SQL

/* Moves by non-autoconfirmed  */
use enwiki_p;
select log_id, log_type, log_action, user_name, user_editcount, user_registration from logging
join actor on actor_id = log_actor join user on user_id=actor_user where log_type="move" 
and (user_editcount < 10 || user_registration > (DATE_FORMAT((NOW() - INTERVAL 4 DAY),'%Y%m%d%H%i%S'))) 
and not exists (select * from user_groups where ug_user=user_id and ug_group="confirmed")
and log_timestamp > "20190501010101" limit 100;
/* Moves without redirect */
select log_id, log_type, log_action, user_name, user_editcount, user_registration, log_params from logging
join actor on actor_id = log_actor join user on user_id = actor_user join comment on comment_id = log_comment_id 
where log_type="move" and log_params like '%"5::noredir";s:1:"1%' and log_timestamp > "20190501010101"  
and comment_text not like "Automatically moved page while renaming the user%"
and not exists (select * from user_groups where ug_user = actor_user and (ug_group="extendedmover" || ug_group="sysop" || ug_group="bot"));
/* Other common admin actions */
select log_id, log_type, log_action, user_name, user_editcount, user_registration, log_params from logging
join actor on actor_id = log_actor join user on user_id = actor_user
where (log_type = "block" || (log_type = "protect" and log_action != "move_prot") || (log_type="delete" && log_action != "delete_redir"))
and not exists (select * from user_groups where ug_user = actor_user and ug_group="sysop") and log_timestamp > "20190501010101"

SQL

Checking query status...