So. Since the LJ-update cgi doesn't (can't?) use a page ID to identify the originating page, you can post to it from anywhere. Very funny, Mr. Jeffrey Paul, though it looks like you just copied the Russian sausage game code. Snort snort you should've made it say "fart".
Friends: your password can not be stolen that way, nor can it be changed, molested, or unnecessarily frightened. LJ has also made it so the whole post-from-somewhere-else thing doesn't work again. You're ok.
Anyway, here's what worries me: People are responding very badly to a childish prank. Death threats? Those are criminal. Denial of service? Also illegal, good way to get fired or arrested. Signing him up for spam lists? Isn't that sort of like giving money to the people who sell YOUR email addresses? Revenge is a loser's game; there's no percentage in it.
( LJ once again checks HTTP_REFERER )