Quick question: Any particular reason for hosting
www.threadsdev.com on the same machine that acts as a mail exchanger for infopop?
You should also consider that the attacker could login as any user, using the encrypted passwords from the database. I can't stress enough that this wouldn't have been possible if the passwords were not checked against values stored in cookies. The session method is the only way to go -- I posted an enhancement ideea and some sample pseudocode (that covered exactly the topic of securing the login/administration process) on the threadsdev site but that is history now).
Also, do you remember which are the default passwords (on this board) of the users imported from the wwwthreads database?
PS. I understand your explanation about reg numbers not being stored on threadsdev but I wonder how the public infopop web server is able to verify them when a registered user logs in the 'members area'. This not actually a question -- since I can think of a safe way of doing it -- but a reminder in the event that you haven't
