Point of interest:

I just heard from a client in France that it was possible to wander up to the logon screen of his DB_M installation, enter no name and no password and be admitted with full editing privileges. (eek!)

On checking into it I found this cause:

There was a blank line at the bottom of the users file.

So--if someone leaves an extra carriage return in the users' file at the end of a manual editing session, that becomes "the authorized user with no name and no password".

added.....

I'm sure what I have wound up doing in the past was to replace the snippet below from "auth-extra-lib.pl" file at approx line 163.

if ($in{'auth_logon_screen_op'} ne "" || 
   ($session eq "")) {
            &PrintLogonPage($bad_logon_message, $main_script, *in);
            exit;
        } # End of Logon Screen

with this hacked snippet below..and that seems to have corrected the problem I think Jeff is describing.

if ($in{'auth_logon_screen_op'} ne "" || 
    ($session eq "") ||
    $form_data{'auth_user_name'} eq "" || 
    $form_data{'auth_password'} eq "") {
            &PrintLogonPage($bad_logon_message, $main_script, *in);
            exit;
        } # End of Logon Screen

There was the infamous :) "last person to enter data into the database became admin bug"...as well as a bug that would nuke the whole database. So if your client a real old version of the DB_Manager...some of these gremlins maybe present Jeff.