Well done, you've definitely found an exploit there :] . I'm not sure how exactly to stop it. I guess three and a half years without anyone finding the problem isn't too bad though. I'll have a think...
I made a little change so it might be harder to do this now, but then I found another exploit and tried to fix that too :]
