Any way to make the USER page private and not readable to guests? Currently, anyone may go to the USER page and read all that user's posts for a prvate forum.
Turn Hide user list and data from guests on in /admin/settings/user and hit save. You should also remove find/read privileges from guests if you don't want them to see content.