circles app and share by mail app enabled
email user has still access!
For every circle share is a non user specific link token created. this token is sent to the email-members.
An other problem is, that if you have forced password usage for link shares and share by mail shares, this link is still accessible without a password.
Tested with:
Nextcloud 15.0.10
Circles 0.16.9
share by mail 1.5.0
A email-member that is removed from a circle