If i remember right, theres some tools in the Auditor live cd for brute
forcing form based sites. It would be easier to tell you in more
detail and about how it was actually working if you specified a site
because there are many ways that different sites do it.