Lets drop the login required. The abuse form really shouldn't require that they are a member themselves. To cut down on abusing the abuse form lets add the url to the session of the request and only allow N number of abuse requests by that person. Sessions *should* work for anonymous users too.