I could unpatch the login exploit since you are running 2.2 but not advisable. You can reset the username and password via phpMyAdmin.
Select the book_auth table by clicking it in the left pane. Click Browse tab in right window.Click the edit button (looks like a pencil). You will now see your username. Type in a new password and select Password from the list of available functions on the password row.
Yes I have already looked at your 2.7 code including the 255 premade images you have for your image verification which prevents your guestbook being used with any language other than English. You should of just made the image contain the characters and left the message as part of the lang file.
Any spammer who is actually going to go to the bother of spoofing the HTTP_X_FORWARDED_FOR header is not going to be stopped by IP banning. As you have now implemented you need to stop the spam from getting posted in the first place otherwise you will end up having to go in and delete the spam entries that get made before your auto ban kicks in.
Advanced Guestbook has come with a required field/time limit since version 2.3.3.
IP banning is not a way to stop spam. It will sto pa few prolific spammers but a lot come from a variety of IP's. That is why I made my anti spam modifications to stop the posts before they happen.
I think it would take more than 10 steps to add the Admin feature. If I get chance I will think about it but right now I am busy working on Lazarus 1.5.1 and some new install/update scripts for it.
Using cPanel. From recent experience they can't get anything right regarding script installation. Download the full guestbook script from this site and replace every file on your server with th enew ones except admin/config.inc.php