Thanks for this, ABB, and to wolf for alerting me on Twitter. This must be a global Activeboard problem and I think I'll need to Sheddie to contact them about it, since the board is registered in his name.

Looking at the settings for the 3 fake mods ABB noticed (one of whom has lots of stuff about pharmaceuticals in their profile, the others lots of stuff about biometric passports), they had given themselves the ability to "Ban Users and IPs" but not anything else (i.e. they have not given themselves the ability to moderate or edit other users' comments, tag threads, edit users' information or make new mods) and I have revoked that access for them, which has taken them off the mods list. However, presumably if they have made themselves mods once, they could do so again until Activeboard solves the problem. I've also changed my password in case they managed to hack my account and mod themselves that way but since they'd have first needed to work out that I was one of just 3(?) mods who can give that access, that seems highly unlikely.

I'm not sure how to completely ban users who haven't posted (none of them have) but maybe there is a way and I'll remember it after writing this - if not, I imagine Sheddie is able to do it.

Hopefully no fake mods will manage to actually ban anyone but if anyone does find themselves banned in the meantime, please either tweet me (@gbtennis) or, perhaps better since he has more advanced access to undo bans, etc, Sheddie (@dcwriter89) - if you're not on Twitter, you can contact another member if you know them personally or register a new account (you'll probably need to do this from a different device/network if your IP has been banned) and PM one of us so that we can try to resurrect your original account.

Since the fake mods all registered more than 6 weeks ago and, as far as I know, no genuine users have been banned in this time, this may well mean that an Activeboard weakness was exploited to automatically create fake mods on loads of Activeboard forums and they haven't actually been used to do anything on this board yet. Of course, it may also mean that the Activeboard weakness was plugged in mid-June and there is no ongoing danger now that I have de-modded the existing fake mods, but if anyone notices any new fake mods from now on, please let us know so that we can de-mod them as quickly as possible.

Mods can't access people's passwords (it's possible that board owners, i.e. Sheddie in our case, can reset passwords, but there's no evidence that the fake mods were able to give themselves that level of access), though these days it always makes sense not to use the same password on more than one site anyway, pain in the neck as that is.