Yeah, we had to take out the ability to reply from the comment form no matter what account you were logged in as because it was a security hole: if you forwarded the notification to someone else, they could reply as you to that comment for the rest of eternity just by entering text in the form and hitting 'post'. (Which is why we had to design this so carefully, to prevent that situation -- now the only way someone can reply as you is IF you forward the email AND that person deliberately spoofs your address, and you can expire the token if that happens.) LJ decided the possibility of forwarding the email notification and someone trying to reply to it wasn't enough of a problem to worry about, though, so that possibility still exists there; if you use HTML emails on LJ, don't ever forward them to somebody else.