I rewrote this piece of code to behave as it was before, including the admittedly dodgy code.  Iterating over all candidates (including the ones scheduled for cleanup) should not be a problem because messages with MemberDestination should only be sent on-demand, i.e. you know its online.

But I do agree that it would be better to handle this using CandidateDestination instead.  Searching for MemberDestination shows that it is only used for the 'dispersy-signature-request' message, I will make an Issue suggesting the change.