Exploit lets me post via someone's account without AUTH

I just discovered a pretty big security hole with your website. It allows me to post an update via someones account without needing to login.

I have sent an email via the contact form, but as a failsafe I will post here too. I don't want to post any details as others may exploit this bug if they see this posting. Feel free to email me for more details: bmn [ at ] bmn dot name, or just follow up the email I sent via the contact form as I have put all the details in there.

Cheers,
Ben