ACL Confusion

[mattyml@bellsouth.net]

I have been playing with ACLs all day, and cannot seem to figure
out why the following ACLs:

access         to      attribute=userpassword
       by      self            write
       by      anonymous       auth
       by      *               none

access to dn.subtree="ou=contacts,dc=test,dc=com"
      by  group="cn=Directory Managers,ou=Groups,dc=test,dc=com" write
      by        self            write
      by        *               none

allow anonymous binds? The following search works for some reason:

ldapsearch -x -D "" -b "dc=test,dc=com" '(objectclass=*)'

>From reading and rereading the access list info on openldap.org, this
shouldn't work. I must be doing something stupid.

Thanks for any insight,
Ryan