When using 'Single Approver' workflow in Message boards, users with certain permissions have the ability to reply to threads even though they are in pending state (See attached 'reply-to-unapproved.png')
PTR-765 for the investigation made in regards to this issue.
0. Start a clean version of Liferay
1. Create new user 'user1' (Control Panel > Users > Users and Organizations) and have it join the default Liferay site
2. Add a Message Boards portlet
3. Site Panel > Configuration > Workflow
4. Set 'Single Approver' workflow to Message Boards Message
5. Login as 'user1'
6. Click "Post New Thread" and input data and click "Submit for Publication" as 'user1'
7. Login as 'admin' user
8. Click on the thread that was posted by 'user1'
No one should have the ability to reply to unapproved messages.
'admin' user (or any user with appropriate permissions ie. portal/site/org content reviewer) can reply to thread from 'user1', even though this thread hasn't been approved yet