The phpbb_delete_users_pms in functions_privmsgs.php does not anonymize attachments in PMs that are anonymized (that is, user ID set to 1), as can be seen at the end of the function. On user deletion, these attachments are left with invalid poster_id values, if the user's posts are not retained.