Just noticed a funny thing. This could probably be a wrong setup ini but it aint that much to put in the ini so i doubt it is.
Ive closed the site added a user and he was added to the NoGroup. This group could access the server even if the admin has closed the site(site close). So I changed the user to same group as admin(ioftpd) and the user can still login even if ive closed the site. Made a new group to check it out and user can login somethings even there.
Try and close the site and disconnect and login with a non 1M(flags) user a few times to check if you can login even if site is closed.
EDIT: Remember that they cant always login. Sometimes the scripts denys login as it should. Another thing, useing 5.5.6r