There is so much wrong with this post that I'm not even sure where to begin. But, here we go.
1. Yes, you can "just go" to their login server and get to "the page". HTTP is a query-response protocol. You provide the session ID within the proper request, you get a login ticket. That's generally how sessions authenticated via HTTP work. Granted, the ticket will be useless to you unless you're using it to provide the client with authentication, but that's the point, isn't it?
2. "Nearly impossible with the current security procedures in Windows"? Are you high? Let's dissect this one.
a. I'd bet my favourite hat that most gamers immediately turn UAC off, never looking back. I don't have a favourite hat. I'll go buy one if I'm wrong here, but I'm not wrong on this.
b. "You'd need admin access to the machine": Most of today's computer problems are solved by "run it as Administrator". Immediately. With no troubleshooting or thought process.
c. "You'd have to download a virus and let it run as admin": See a. and b. If you're running everything as an administrator, or you've disabled UAC, everything you download can "run as admin" if it chooses to do so. Not that we really "download" viruses anymore, as many of them are malicious content delivered by web, but anyway... yeah. You're probably running it as admin anyway.
d. Notwithstanding c., you don't even need to be an administrator to do various things. For example, you don't need to be an administrator to access the clipboard (for people that copy/paste their passwords because they figure that can't be keylogged).
I sincerely hope you're not in IT for a living.