Yes, this is a limitation of how it works, there's no tracking to points being awarded and validation is assumed to happen only once.

I'll keep this here as a possible improving, for us to add that tracking.

Assigned to Patrick, as more integrity around points will be important with our AutonomousOrganization changes.
I think it'd be pretty easy - just look to see if an Action Log message exists for validating that content type+ID combination, and if so, don't give points again.

I had misunderstood this issue. I had thought that we were assigning points to validated content in Composr, in general. Actually point awarding has nothing to do with content validation. Polls is a special case though because you get points when the poll is SET, which is piggy-backed on the validation system.

The issue in general raised a lot of questions, and Patrick and I discussed. I decided to just handle it myself.

1) This issue is specific to polls. It should not be a thing that non-privileged users are setting polls. The polls CMS is based on mid-impact permissions which generally makes sense (we want to encourage user submission of this content on many community sites), but not for SETTING the poll, or for EDITING IT. So I have resolved this issue by having the default installation override the mid-impact validation/self-content-editing privileges for poll CMS to be off for any non-staff usergroup.

2) We questioned why we assign points based on submission, not based on submitting-as-validated/subsequent-validation, and tracking it so that the points are only assigned once. The reasoning is that we are not trying to reward ACCEPTABLE submissions, we are trying to award EFFORT. If staff then want to come in and give extra points, or take some points away for spammy content (which they can easily do on the member punish form), they have the choice to do this.

3) We questioned why there is no action-log tracking for when content is validated. Tracking of all changes would be achieved via #2119, so we shouldn't be looking into adding specific validation logging at this point.

Actually I am also going to make it not award points for a poll that was already set. It's not hard to do as a special case. I'm not going to skip re-syndication though, as an old poll can legitimately be put back with an expectation it will re-syndicate.