That is really surprising!
When the default
`.htaccess` is there and active NoNonsenseForum should already be generating friendly URLs and you should never see “thread.php” linked to from anywhere. 
The only thing I can think of is that detection of the
`.htaccess` is failing. But if that is the case, your forum shouldn’t be working at all and should instead be telling you your users folder is at risk.  Unless you have moved the users folder to a different location already?
Can you tell me a little more about your server setup? It sounds like you have hit upon some sort of edge-case here!