All sorted. Turns out the guy I had told the fake password to tried to log into my account. The next time I tried to log in the auto security kicked in and asked for verification (captcha). Good to see the system works against dirt-bag account stealers.

It looks like this and it has never done it before. It doesn't do it on my other two accounts. blowmygoat is a commander.

I was in the forum earlier and a member was offering free crystals and hack etc. I spoke to him and said he will enjoy his ban for offering hacks. Now I think he might have attached a hack to my account. Every time I try to log in to it it comes up with another security question, none of my other two accounts do it. My account in question is blowmygoat. Any ideas?