How can I limit authentication to existing users?
Ok, thanks Iñaki - I really appreciate your help on this.
If it was my Moodle instance, I'd go ahead with your suggested approach. Unfortunately it is an instance that belongs to a client of mine, and they won't go for this - they are too risk averse for this approach.
So I will continue to encourage them to upgrade to the latest version of Moodle - this being another reason on the list. (Of course, they are also averse to upgrading! )