[Loriel]

I saw the link.
It led to a script that was clearly distinct from showthread.php.
It contained no threadid.
It more or less clearly had an incomplete html tag.

Does not look really valid to me.
Yah, of course the problems is the buggy forums code, but the password was stolen nevertheless.