I'm giving one of my old hosts to a family member (team mate) with a completely different hard drive and new OS install. However, when I install BOINC and sign in to BAM using his account details, the host shows up at my account at BAM and therefore attaches to the projects as me! This is a completely different and wiped hard drive, so there's no way it is pulling account data from an earlier installation or something... What the heck is going on?

BAM! tries to match the host on:

1. host authenticator
   
2. cpid + IP
   
3. previous cpid + IP
   
4. hostname + IP
   

If any of these match is will be the same host again.

Interesting... And the host is permanently associated with a user account, even when a different username & password combination is entered to attach to BAM?

Yes. I might have made a bad choice there when I first coded this.

Changed it, if an existing host is attached with new user credentials it should create a new host in BAM!.

Awesome, that makes everything line up as it should. Thanks!