Yep, do a google search for "punbb img avatars" and you'll see a few dot pages on there.

After deleting a user, the uploaded avatar still remains in the avatars directory.

The dummy index.html files really should have this tag, so that google doesn't pick up those pages.

<META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">

I've already seen google pick up a few dummy pages from the Attachment Mod.

Should links to pages marked as NOFOLLOW in their meta tags also get this attribute on all links pointing there?

I added that stuff, still broken.

I saw that it looked bad, and immediately reverted the hack so it's back to text/html now, but I have a somewhat related site:
This is using a php script to fetch news items off a punbb forum, and it uses punbb's stylesheets for the boxes.
Both sites have identical HTML content.  First site is served as "text/html", second site as "application/xhtml+xml"

http://www.dwedit.org/
http://www.dwedit.org/new_index2.php

You can see that the news boxes fail to show up on the second site in any browser other than IE.

EDIT:
I've just copied my message board to a second version.
First version:
http://www.dwedit.org/dwedit_board
Second version:
http://www.dwedit.org/dwedit_board_copy

In the copy, I added this line to the top of include/common.php.  Let me know if I did this change completely wrong.
header("Content-Type: application/xhtml+xml; charset=utf-8");

I'm having an issue with PunBB.  When I change it so that the page is served as "application/xhtml+xml" instead of "text/html", the stylesheet gets completely messed up, almost none of the styles look correct.  This is on Firefox Beta 3 and Opera, MSIE doesn't care and displays it the usual way.

Also, if the page is being served as "text/html", is it really XHTML at all, or just funky HTML?

Thanks, I did something like that, then also modified post.php to reject guest posts which contain URLs.

I was just looking through register.php, and noticed that it does converts timezone to an integer value, but the list of time zones contains noninteger values as well.  Is this a bug?

The offending line:
$timezone = intval($_POST['timezone']);