I'm not sure if the question asked is even the right question (what tone to use isn't the problem). The code review should educate the developer submitting it if they don't know the points you are making. If they do know the points, I would tell them to review their own PR before another person since it helps everybody. We shouldn't be asking for approval for code that's not even double checked.. that throws the responsibility for catching bugs on the reviewer and not even the writer.
If they already self reviewed the code and it has problems, you can write a more detailed message explaining why there's a better way to do things. This way it doesn't come off negatively because the comment is a constructive suggestion. You may also have to compromise some lower priority feedback for development velocity as long as the submitter understands and can improve in the future.
If they already self reviewed the code and it has problems, you can write a more detailed message explaining why there's a better way to do things. This way it doesn't come off negatively because the comment is a constructive suggestion. You may also have to compromise some lower priority feedback for development velocity as long as the submitter understands and can improve in the future.