That's... odd.

Private forum access rights are based on an additional cookie that contains the password. This password is checked against the current forum password on each request.

Are you sure that these were passworded users, as opposed to having explicit permission to the forum?

This thread for sale. Click here! [Linked Image from navaho.infopop.cc]