DefaultUserChecker doesn't lock the cache retrieved with getCache before getting and putting the NUMBER_OF_REGISTERED_USERS Integer.

In code like:

if (getNumberOfRegisteredUsers() > 0)
getCache().put(NUMBER_OF_REGISTERED_USERS, new Integer(getNumberOfRegisteredUsers() + 1));

this could invalidate the if test (which should operate on an int local variable).