The primary issue is that the architecture is just all wrong to defend this content. Images are uploaded directly into a bucket and then the albums are linked to the relevant images. So if you can dump their uploads (such as in recent submissions) you bypass any kind of album level protections. These aren't all models building a portfolio. They're husbands and wives; mothers and fathers. Children. Deceased relatives.

Let's update this. It doesn't matter if users hide albums or make them private behind a password. The api leaks ALL updates in recent photos. A photographer using smugmug is exposing their clients' photos to the web full stop. Post Partum, Boudoir, Family wakes...everything. Further still, the RSS feed that most users leave on by default allows for a stream of recent photos that is viewable by an RSS reader. No scripting required. No api key needed. If your photographer uses smugmug, dont use that photographer.

@czarbucks Dr Horrible's Singalong Blog was excellent. I can't find a good digital copy anywhere though. Every one I find is incomplete. I add The Mighty Boosh. Its known for Old Gregg of course, but in my opinion the whole show is excellent.