I'm not sure if this is miniBB's behavior to log-in automatically even if the password been emailed...
I've checked this issue today, and could confirm that default miniBB script does not perform the auto-login, if a Registration process been tied up with emailing the password (i.e. if you have $closeRegister
option set to 1, there should be no auto-login after registration).
This is how it should work, bb_func_regusr.php
contains a clear condition:
if(!isset($closeRegister) or $closeRegister==0)
which locks the auto-login.
I'm not sure why it was being logged-in automatically on your forum while this option set up... you should take closer care of it. It's out of logics to auto-login the user, but trying to verify the email address at once. Doesn't make sense...