I think there were some problems with either the account creation code or the login code. Today someone managed to create an account, then log in, trigger the login event, but not actually, y'know, log in. I looked at the code and decided this was impossible, but yet, it happened.
Then I looked at the code some more, swore a couple of times, rewrote a bit, and concluded it might happen if you have cookies turned off, or refuse one of the cookies set during the login process. I can't believe I hadn't checked for this already, but there you go.
All the changes I made have been pushed onto the live server, so this bug should (finally) be fixed. There have been a number of login-related bugs so far. I think I must have been drinking when I wrote the original script.