Is the security token been assigned to the correct hidden input? All user-end forms should really just have this within the <form> tags:
Code:
<input type="hidden" name="s" value="{vb:raw session.sessionhash}" />
<input type="hidden" name="securitytoken" value="{vb:raw bbuserinfo.securitytoken}" />
It's what I use on several vB4 modifications and it works just fine