Welcome to OpenACS!
Apparently the "authorization" is implemented by hiding links... As for the fix, apart from checking the policy to show/hide actions, guards should be added to the Tcl scripts that add a new thread or a new message.
Could you post your patch at the bugtracker?
Thanks for catching that.
