[vbboarder]

Re: multiple usergroups & can_bypass permissions

I think your 3 can_bypass permissions (hit_recording, bandwidth_limits, forumperms) are like a tertiary level of access control. To prevent the permissions dilemma that you're debugging, I think you should remove those permissions from usergroups and make them specific to listed users (ie: userids, usernames). These liberal permissions should then override the usergroup permissions for any listed users who have those permissions.
Users can configure their desired access control for usergroups without using these 3 can_bypass permissions by editing Forum Permissions, LDM Permissions, and LDM Allowances. The only possible loss functionality that I see is the can_bypass_hit_recording for the Guest group. To compensate, you can provide an option to activate that setting for the Guest group, but guests will then have either no or unlimited download/ upload limits (depending on the settings in LDM Allowances).