The password thing should be a simple fix I think, so thats nothing too major.
The main other problem is that we have no way to remove people from the usergroup (ie. no way to ban them from being able to access the forum). Which means as soon as a spy gains access, we have no way to get them out again. Would it be possible to change that, please?