And you are correct in that if all your forums require people to be logged in to post, then the referer check holds even less value as they need to actually be online to post and can't really do a remote script.