-A third-party toolbar with an in-browser keylogger and a forced Gaia logout upon installation. If tektek and a few other crappy gaia fantards can be trusted with toolbars, why can't we? It'd be simple enough to set up a fake page or two with some nice graphics, screenshots and a few basic features.

-A .hta program, if anyone is good with Javascript, that forces the victim to spam. After 5 posts, CAPTCHA stops any spammers, but if the user is submitting text and it's swapped or appended by this program, they will continue to fill out CAPTCHA and things will continue. Great in that it would allow more people to download/run said program, but there isn't very much that could be done with it in the way of actually stealing accounts, so...

I don't know. I'm bored, I'm tossing around ideas in my head.