If someone else created the account for you, not yourself, then the account key never changes and they can get in. You could request the account key is changed but that will require a direct change to the database by the project admin (unlikely).
If it was created by boincstats then that's not a big deal.
on world community grid, at least, there is a reset weak key button. i pressed it, and am pleased by its placebo effect so far. :D