And you're 100% certain that it's Bob's profile Joe can edit by doing this and not his own? If Joe tries to edit Bob's profile and enters his own username and password he should see an invalid username/password error. Have you made any changes to your forum's code, in particular to pop_profile.asp?
I did not change the pop profile except for putting in mlev=4 on some lines to prevent members from looking into some info in the member's profile
FYI My wife's username and password for my forum was able to change my profile in your forum! I am using IE and the Forum version is the latest .06
Well I just tried that in my local forum, logged in as admin, clicked profile, used a regular member password ... and the forum informed me that I had inserted a bad username / password, even though I inserted a correct username / password, but for another user.
This means that your issue is tied to something in your system or forum, as several people stated before.
Weird.. I'm no programmer and I dunno how or why that happened. Sorry for taken your time guys/gals... Appreciated your "looking under the hood for those that don't know how the car runs"!