To expand on Cameron's post, even though you probably already know: Forum posting is not CSRF-protected either, not even by referrer.

Stuff like http://pastebin.com/EpJQmqPB

works flawlessly.