I am creating a bot that will post on a forum with python (outside of the forum), and i was using relative URIs in the Referer header of the POST to posting.php. Instead of posting or giving me the "bad POST data received" error, it logged me off. as i also have control of the forum, i did a little debugging and i think it's the $is_authed block at line 231 in posting.php. that's where the login_box is put in.

and that's about all i know. i was directed to submit a bug report here:
http://www.phpbb.com/community/viewtopic.php?f=71&t=1630645