[Bellardia]

A password is even easier to abuse than a cookie.
The spammer only needs one per account, and rarely has to log in more than once, thus it could create a totally random PW and it wouldn't make a difference.

If you really insist on doing this you could add an extra hidden field in the login form, on form submit (this.value=getElementsById(vb_login_password).val ue). Then modify the login page to store that field.

I won't really help you further because it's not a good idea. You're willing to jeopardize your sites security to try and find spammers that use the same password. Might as well just allow the 'random' salt to be a fixed value so the same passwords have the same hash.