Wait a minute... At the very top of ubb_upload_form.cgi, the following code exists:
if ($username eq '') {
&StandardHTML(qq!$vars_wordlets_err{not_logged_in}
<A HREF="$vars_config{CGIURL}/ultimatebb.cgi?ubb=login">$vars_wordlets{login_now}</A> $vars_wordlets{or} <a href="$vars_config{CGIURL}/ultimatebb.cgi?ubb=agree">$vars_wordlets{register_title}</a>!);
}
That should stop unregistered users in their tracks. I don't understand how that doesn't work on your UBB, unless you've been modifying the contents of $username after it's been set or something...