Check that you create a user at the subscriber level, and post a reply containing the script tag. It should not allow you to do this (or at least that is the case with me).
Within the administration screens, or at a different user level other then subscriber maybe a different story.
