Any person with the correct activation key can activate an inactive account that requires activation by an administrator. This is not a huge problem on its own but the remind inactive users function in the ACP (until 5 minutes ago) used to send out the activation link to users when admin activation was required. doh!

Created the ticket to keep a track of it.