Hi !
I think, all this sounds rather interesting - I'm sure the project could benefit from it.
Even if there shouldn't be any immediate dev-team feedback because of their time-constraints , the project itself might extremely benefit from the work that you mentioned above and would have to do anyway.
So, examining and
documenting the architecture (code & db) is probably well worth it in its own - regardless of any security holes that you might find, said technical docs would certainly be very welcomed by many people. So, writing down the purposes of each file, function, object and method would probably be pretty useful in itself - as well as documenting what files/functions are accessing what tables.
I'm pretty sure that such technical docoumentation would ultimately turn out to be very useful to many people, however I doubt that something like that can be managed within 2-3 months - it's quite a job to document software that you've written yourself, to document software that others have written can become quite a challenge, particularly without any developers involved.
On the other hand, making use of source code documentation tools would probably simplify the task a lot.
Also, as long as you keep planning to do this review while the actual development itself goes on, it would probably be wise to really talk to the authors, so that you folks can concentrate on those parts of the code that are close to finished, instead of examining and debugging any pre-alpha code that might be subject to change anyway.
While I am currently not sure whether I could really afford the time to be of much use to such an undertaking, I'm definitely very much interested in it - indeed, security-related thoughts originally made me sign up here. So, I'm not sure how many people you have currently attracted to your idea, but personally I'd definitely love to get some more information - you mentioned various docs that one should have read, I'd like to suggest that you assemble some simple information package and make it downloadable anywhere, so that everybody can check out everything in order to be able to make a realistic assessment about the required level of expertise to be really helpful.
You said, that you were understandably looking for as many helpers as possible, I guess you could attract an even larger audience by posting at phpBB.com - there seem to be plenty of folks who are familiar with the internals of phpBB, and even more important: the folks there seem to have much more spare time at their hand than the dev team itself, or even those users that are registered at area51.
I'd recommend to formulate some requirements (i.e. php/sql knowledge, phpBB familiarity, 1-xx hrs spare time/week, regular internet access etc.) and post a summary of what you have described above.
So, if you introduce your goals and provide some basic information about the requirements, as well as making available a package that contains all relevant security related docs, it's gonna be much easier for people to really decide whether they can/want to contribute or not.
P.S.: Taking into account your security-related background, I have to admit that I'd love to see some feedback from you about my
idea to potentially increase phpBB's security towards SQL injection attacks by requiring a dynamic scope/context for each query in order to validate each query before actually executing it.