Why: Look at this. The SQL is missing "user u" in the FROM part, and missing "AND u.userid=ui.userid AND ui.userid=u.userid" in the WHERE part.
Patch: 2002-05-20-directorylib.pl.diff. This patch has not been tested, because I don't know how (or if) I can get the directory to work on my goathack. I've looked the code over pretty carefully, and this seems all right. If someone else could test this (or use the information I've given to write a better patch), that'd be great.