I used to have the site mentioned set to passwords. I then set it to invitation only. Recently someone asked me about the site and I told him to ask for an invitation. He did not ask for one but discussed things on the site. He was not showing up in the activity log. He then told me that he had been given a password in the past and asked for the forgotten password to be sent to him. So he has got onto my site without me knowing about it. Goodness knows how many others are doing the same. Surely, once it is changed to invitation only it should cancel out the old system.