if memory serves me right, IAH forums have always been crappy and their insistance on tying the game login to forum is just.. well asking for trouble.

even back days when GE first started, there were already game accounts being hacked via the forums. i believe back then it was done with some javascripting. hacker would create a post which embeded the javascript and when unsuspecting ppl open it to read. bam! get hit by it already.

guess they never did learn after all these years