phpmyfamily

When a visitor (someone who's not logged in) clicks to
download a document and then leaves the page, they
are automatically logged in as 'nobody.'
'Nobody' now has the right to add people, change
information, upload and delete documents and images,
and is even given the option to change password
(although not sure what the system considers the
current password to be).
Of course, they do not have the option to admin, it's
just as if I had created a user called nobody. When
logged in as 'nobody' if I try to access admin.php, I get
the forbidden error, and then am logged back out
completely when returning to the page I was just at.
I am using version 1.3.0.