Thanks for posting that gist!
I’ve copied your code here: http://dtbaker.net/files/envato/test_api.php (view the code I used here: https://gist.github.com/dtbaker/8b7898780e2dfbb993fc )
It seems to work just fine, I can login to my main account and a test account, and both times they show the correct username at the end. Are you getting different results?
The comment search API should be limited. It is has a major security flaw.
Best to send any potential security issues over to https://help.market.envato.com/hc/en-us/requests/new?ticket_form_id=38490 rather than discussing here on the forums.