Index: src/wp-admin/includes/ms.php
===================================================================
--- src/wp-admin/includes/ms.php	(revision 45674)
+++ src/wp-admin/includes/ms.php	(working copy)
@@ -304,59 +304,6 @@
 }
 
 /**
- * Update the status of a user in the database.
- *
- * Used in core to mark a user as spam or "ham" (not spam) in Multisite.
- *
- * @since 3.0.0
- *
- * @global wpdb $wpdb WordPress database abstraction object.
- *
- * @param int    $id         The user ID.
- * @param string $pref       The column in the wp_users table to update the user's status
- *                           in (presumably user_status, spam, or deleted).
- * @param int    $value      The new status for the user.
- * @param null   $deprecated Deprecated as of 3.0.2 and should not be used.
- * @return int   The initially passed $value.
- */
-function update_user_status( $id, $pref, $value, $deprecated = null ) {
-	global $wpdb;
-
-	if ( null !== $deprecated ) {
-		_deprecated_argument( __FUNCTION__, '3.0.2' );
-	}
-
-	$wpdb->update( $wpdb->users, array( sanitize_key( $pref ) => $value ), array( 'ID' => $id ) );
-
-	$user = new WP_User( $id );
-	clean_user_cache( $user );
-
-	if ( $pref == 'spam' ) {
-		if ( $value == 1 ) {
-			/**
-			 * Fires after the user is marked as a SPAM user.
-			 *
-			 * @since 3.0.0
-			 *
-			 * @param int $id ID of the user marked as SPAM.
-			 */
-			do_action( 'make_spam_user', $id );
-		} else {
-			/**
-			 * Fires after the user is marked as a HAM user. Opposite of SPAM.
-			 *
-			 * @since 3.0.0
-			 *
-			 * @param int $id ID of the user marked as HAM.
-			 */
-			do_action( 'make_ham_user', $id );
-		}
-	}
-
-	return $value;
-}
-
-/**
  * Cleans the user cache for a specific user.
  *
  * @since 3.0.0
Index: src/wp-admin/network/users.php
===================================================================
--- src/wp-admin/network/users.php	(revision 45666)
+++ src/wp-admin/network/users.php	(working copy)
@@ -76,22 +76,33 @@
 
 								$userfunction = 'all_spam';
 								$blogs        = get_blogs_of_user( $user_id, true );
+
 								foreach ( (array) $blogs as $details ) {
 									if ( $details->userblog_id != get_network()->site_id ) { // main blog not a spam !
 										update_blog_status( $details->userblog_id, 'spam', '1' );
 									}
 								}
-								update_user_status( $user_id, 'spam', '1' );
+
+								$user_data         = $user->to_array();
+								$user_data['spam'] = '1';
+
+								wp_update_user( $user_data );
 								break;
 
 							case 'notspam':
+								$user = get_userdata( $user_id );
+
 								$userfunction = 'all_notspam';
 								$blogs        = get_blogs_of_user( $user_id, true );
+
 								foreach ( (array) $blogs as $details ) {
 									update_blog_status( $details->userblog_id, 'spam', '0' );
 								}
 
-								update_user_status( $user_id, 'spam', '0' );
+								$user_data         = $user->to_array();
+								$user_data['spam'] = '0';
+
+								wp_update_user( $user_data );
 								break;
 						}
 					}
Index: src/wp-includes/ms-deprecated.php
===================================================================
--- src/wp-includes/ms-deprecated.php	(revision 45666)
+++ src/wp-includes/ms-deprecated.php	(working copy)
@@ -685,3 +685,48 @@
 
 	$wpdb->suppress_errors( $suppress );
 }
+
+/**
+ * Update the status of a user in the database.
+ *
+ * Used in core to mark a user as spam or "ham" (not spam) in Multisite.
+ *
+ * @since 3.0.0
+ * @deprecated 5.3.0
+ *
+ * @global wpdb $wpdb WordPress database abstraction object.
+ *
+ * @param int    $id         The user ID.
+ * @param string $pref       The column in the wp_users table to update the user's status
+ *                           in (presumably user_status, spam, or deleted).
+ * @param int    $value      The new status for the user.
+ * @param null   $deprecated Deprecated as of 3.0.2 and should not be used.
+ * @return int   The initially passed $value.
+ */
+function update_user_status( $id, $pref, $value, $deprecated = null ) {
+	global $wpdb;
+
+
+	_deprecated_function( __FUNCTION__, '5.3.0', 'wp_update_user()' );
+
+	if ( null !== $deprecated ) {
+		_deprecated_argument( __FUNCTION__, '3.0.2' );
+	}
+
+	$wpdb->update( $wpdb->users, array( sanitize_key( $pref ) => $value ), array( 'ID' => $id ) );
+
+	$user = new WP_User( $id );
+	clean_user_cache( $user );
+
+	if ( $pref == 'spam' ) {
+		if ( $value == 1 ) {
+			/** This filter is documented in wp-includes/user.php */
+			do_action( 'make_spam_user', $id );
+		} else {
+			/** This filter is documented in wp-includes/user.php */
+			do_action( 'make_ham_user', $id );
+		}
+	}
+
+	return $value;
+}
Index: src/wp-includes/user.php
===================================================================
--- src/wp-includes/user.php	(revision 45674)
+++ src/wp-includes/user.php	(working copy)
@@ -1468,14 +1468,15 @@
  *
  * Most of the `$userdata` array fields have filters associated with the values. Exceptions are
  * 'ID', 'rich_editing', 'syntax_highlighting', 'comment_shortcuts', 'admin_color', 'use_ssl',
- * 'user_registered', and 'role'. The filters have the prefix 'pre_user_' followed by the field
- * name. An example using 'description' would have the filter called, 'pre_user_description' that
- * can be hooked into.
+ * 'user_registered', 'spam', and 'role'. The filters have the prefix 'pre_user_' followed by the
+ * field name. An example using 'description' would have the filter called, 'pre_user_description'
+ * that can be hooked into.
  *
  * @since 2.0.0
  * @since 3.6.0 The `aim`, `jabber`, and `yim` fields were removed as default user contact
  *              methods for new installations. See wp_get_user_contact_methods().
  * @since 4.7.0 The user's locale can be passed to `$userdata`.
+ * @since 5.3.0 The `spam` field can be passed to `$userdata` (Multisite only).
  *
  * @global wpdb $wpdb WordPress database abstraction object.
  *
@@ -1509,6 +1510,8 @@
  *     @type bool        $use_ssl              Whether the user should always access the admin over
  *                                             https. Default false.
  *     @type string      $user_registered      Date the user registered. Format is 'Y-m-d H:i:s'.
+ *     @type bool        $spam                 Multisite only. Whether the user is marked as spam.
+ *                                             Default false.
  *     @type string|bool $show_admin_bar_front Whether to display the Admin Bar for the user on the
  *                                             site's front end. Default true.
  *     @type string      $role                 User's role.
@@ -1644,6 +1647,13 @@
 	) {
 		return new WP_Error( 'existing_user_email', __( 'Sorry, that email address is already used!' ) );
 	}
+
+	if ( isset( $userdata['spam'] ) && ! is_multisite() ) {
+		return new WP_Error( 'no_spam', __( 'Sorry, marking a user as spam is only supported on Multisite.' ) );
+	}
+
+	$spam = empty( $userdata['spam'] ) ? 0 : (bool) $userdata['spam'];
+
 	$nickname = empty( $userdata['nickname'] ) ? $user_login : $userdata['nickname'];
 
 	/**
@@ -1723,7 +1733,7 @@
 	$admin_color         = empty( $userdata['admin_color'] ) ? 'fresh' : $userdata['admin_color'];
 	$meta['admin_color'] = preg_replace( '|[^a-z0-9 _.\-@]|i', '', $admin_color );
 
-	$meta['use_ssl'] = empty( $userdata['use_ssl'] ) ? 0 : $userdata['use_ssl'];
+	$meta['use_ssl'] = empty( $userdata['use_ssl'] ) ? 0 : (bool) $userdata['use_ssl'];
 
 	$user_registered = empty( $userdata['user_registered'] ) ? gmdate( 'Y-m-d H:i:s' ) : $userdata['user_registered'];
 
@@ -1752,6 +1762,10 @@
 		$data = $data + compact( 'user_login' );
 	}
 
+	if ( is_multisite() ) {
+		$data = $data + compact( 'spam' );
+	}
+
 	/**
 	 * Filters user data before the record is created or updated.
 	 *
@@ -1848,6 +1862,28 @@
 		 * @param WP_User $old_user_data Object containing user's data prior to update.
 		 */
 		do_action( 'profile_update', $user_id, $old_user_data );
+
+		if ( isset( $userdata['spam'] ) && $userdata['spam'] != $old_user_data->spam ) {
+			if ( $userdata['spam'] == 1 ) {
+				/**
+				 * Fires after the user is marked as a SPAM user.
+				 *
+				 * @since 3.0.0
+				 *
+				 * @param int $user_id ID of the user marked as SPAM.
+				 */
+				do_action( 'make_spam_user', $user_id );
+			} else {
+				/**
+				 * Fires after the user is marked as a HAM user. Opposite of SPAM.
+				 *
+				 * @since 3.0.0
+				 *
+				 * @param int $user_id ID of the user marked as HAM.
+				 */
+				do_action( 'make_ham_user', $user_id );
+			}
+		}
 	} else {
 		/**
 		 * Fires immediately after a new user is registered.
