If you are hosting multiple blogs on a single installation of Subtext, the recent Subtext 1.5 release unfortunately introduces a security bug that will allow an admin of one blog to login to another blog. The fix has already been posted to Sourceforge as part of the Subtext 1.5.1 release.
If you already upgraded to Subtext 1.5, you only need to update the
Subtext.Framework.dll file in the
bin directory. The fix was a one
line code change. I apologize for the inconvenience and for the mistake.
Please spread the word.