Have you tried any of the command line tricks that work on the early models of OS X? To me that flaw looks like it's built in and they didn't notice the loophole until later.
Maybe something to try? (I am shooting in the dark on this one)
Power on or restart your Mac.
At the chime (or grey screen if your chime is turned off), hold down Command+S on your keyboard to enter single-user mode.
This step is optional, but it’s a good idea because it checks the consistency of the hard disk before moving on. At the prompt, type fsck -fy and press Enter/Return. Wait for the checks to complete before going to the next step.
Type mount -uw / and press Enter.
Type launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist and press Enter.
Type ls /Users and press Enter. This lists all of the usernames on the computer – helpful if you don’t know or remember what these are.
Type dscl . -passwd /Users/username password and replace “username” with one of the users displayed in the previous step. Replace “password” with a new password of your choice. Press Enter.
Type reboot and press Enter.