However, although it doesn't seem like they've tried to do anything actively malicious yet short of self-replication, it may be theoretically possible for them to submit other forms besides the new-post ones. This ranges from posting in friends' journals (just another irritant) to adding themselves as friends (slightly more annoying) to actually changing your password and thereby locking you out, or changing your LJ's email address to their email and turning on email notification of password changes. In the latter case, changing your password would actually be a bad move, since that would actually tell them the new one.
See this discussion in lj_dev for more technical details, if you're so inclined. Remember: that's the LJ developers' community, so it's for trying to figure out ways of closing the security hole—don't just post requests for help or complaints.
Stay safe out there, kids!