Logs did not track POST variables, so I don't know, which is much of the problem in tracking this down.

He created a new user account.
Used a 2nd browser to POST something to ubbthreads.php 3 times.
Went back to original browser and had Administrator access.