Is this behavior by design ?
My understanding is that the guest role should prevent an account from contacting a user who hasn't contacted them first whether via dm or message to a channel they have access to, if this is the case then being able to see other users via autocomplete is a security issue - the /msg autocomplete for example doesn't allow that.