Sorry if this is already elsewhere on the forums but I don't see it here:
The Guardian has
a story on a guy who threw away his boarding pass which had his name and FF number on. The Guardian's reporter picked it up and was able to book a flight in the guy's name and by inputting the FF number during the ticket purchase got his passport number etc. etc.
As a BA FF holder I am very annoyed if this is possible - I usually log in at the start of the process but would have expected entering an FF number later in a manner that would disclose information to require a pin number.
Originally seen on Slashdot.