It'll sound dumb, are they accessing your site through:
http://yoursite.tldor
http://www.yoursite.tldI ask because I think the search forum sends the search to the www version of your site and they may not be logged into the www version (as the "www" on your domain is meerely a subdomain the cookie would be set on whatever url they logged in on).