I just renamed the dir from home to home2 yesterday instead of worrying about it on Christmas.
Added the following to apache and seems to block them before BFD does. At least the 179 guest has left the server since adding it!
RewriteEngine On
RewriteCond %{QUERY_STRING} ^(.*)highlight=\%2527
RewriteCond %{HTTP_COOKIE}% s:(.*):\%22test1\%22\%3b
RewriteRule ^.*$ -
http://www.phpbb.com/phpBB/viewtopic.php?t=249010
I added this site wide on the server.