Oh but wait it gets worse. There's basically no way to fix this without completely unwinding the protocol, because there's no concept of _ownership_.
So what do you do with an event that has two actors if one of those actors gets deleted?
The protocol is silent on how you should handle this sort of thing.
You can reasonably say that this isn't a "protocol-level" thing, but if you say that then it means AP is entirely unsuited to most privacy-sensitive applications.