Hey rudikman,
Have you attempted to fake referrals with using proxy and creating new accounts?

Edit: We've had a bruteforce protection on login page and it caused that processor usage and virus alert on some clients. We've changed our protection script, you shouldn't see that now.