Until we can get more time to investigate the problem (I have family over this weekend for example!) I have disabled/removed the code that does the password changing so now if this is someone being an asshole they will just be greeting with a 404 note now.
Atleast you can be sure your passwords will now remain constant for more than five minutes.
I am going to be so pi**ed off if this turns out to be someone playing games, and if you’re reading this, we will find you and we will push this through the legal system. *sigh*