Cumulus Support

What I have been doing is forcing the user to reactivate their account. I find that is more useful than resetting their password as the user has control of the process. It also means that if the spammer has compromised the users email and has access to the reactivation email, then when they next post it requires approval via a moderator - I've caught two of these already.

I don't feel that phpbb has been compromised - it's more a case of user email accounts being compromised, or users using easy-to-guess passwords