Charming - it's been a while since I've touched a torrent, let alone a private one, things have obviously changed. Last time it was around, the equivalent of an API key was stored within the torrent file, allowing anyone in possession of the file 'access' to the website. By access, I mean access to RSS feeds and the like, allowing someone to effectively utilise the account with HTTP(S) calls.

Edit: Still appears to be the case. Get the users unique code (call it what you will) from the .torrent, and understand the RSS URL structure for said website, and you've got yourself download links for all the torrents by using someone else's account.