I've closed all tasks created by the bot and delete the comments he made on existing tasks. I also changed his pass and email address, so he cannot login again. Unfortunately seems Flyspray doesn't allow to ban users, nor delete tasks. If anyone wants to investigate how to more permanently delete this spam information please do so. I guess there can be scripts to run on the db created by someone facing the same issue.