There is some backend support for any user to flag a post as spam, but is not used. Way back in [#887] it was removed, and so the def flag
method and FlagPost
widget are not used now. It would be good to review how that works and restore it in an effective way. The moderation list does still have a field to view posts with at least "n" flags.
One minor specific detail: the flagged_by
list of user ids should probably not be exposed in the API.