I've tried a bunch of usernames and passwords and cannot replicate this, though we'll continue checking. David emailed us with a username/password combo that worked, but it worked because it was a legitimate combo (legitimate with a very, very poorly chosen password). Please email me at chris@codeproject.com with some samples that worked and I'll dig in. Thanks for the warning.
cheers, Chris Maunder The Code Project | Co-founder Microsoft C++ MVP