I suspect that yesterday somebody got into one of the admin accounts on my forums and went into the control panel and messed with stuff, particularly unchecking the "Disable HTTP referer check." Anyway, I'm not sure what else he did but there is now an issue where unless you are already logged in, it won't let anyone login. My account is logged in so I can go in and see that all the users come up fine when I search them in the control panel, but if I go into a different browser where I'm not logged in, it won't let me login and will say "Login name/password not found" or whatever. This is happening for every user of the forum as far as I know. I even created a new account and then tried to login with that, but it again said Login name/password not found.

Any ideas what could be causing this? Particularly something that could be done from the control panel that would cause this? Because the guy only got into the control panel, so whatever change he made that is causing this would have had to be done there...

Thanks in advance.

Not sure what version you have.
But if you can access to the control panel goto
Control Panel » View Admin Logs
Change the date to before the problem started and see what changes were made that will at least give you a clue on who and what area was changed.

Myself I have disabled the referer check due to users can't figure out how to enable ther internet security options that would not allow them to login. You might need to run the clear cache setting after changing it back to disabled.

I tried clearing cache but that didn't work. This is for version 6.5.2 by the way. All users remain locked out unless they were already logged in. If anybody tries to login, it says Login name/password not found...

Anybody have any other ideas?

6.5.2 had a few security issues, so that could be coming into play. If you have something like phpmyadmin installed I'd take a look at your w3t_Users table, specifically the U_Password field and make sure that things look ok. It's possible if your forum has been compromised that they've ran some database queries to change things.

Also, make sure everything looks ok with the cookie settings in the CP.