IIRC, checkUserPMs only gets substituted when pages are served up via ServeFromCache. I don't think I did that for TAT...
*edit* Yup. I'm using OpenTimedCachedFile instead...
*edit2*
Here, try this.. completely untested.
In ubb_search.cgi, find:
if($tp) { print $tp; exit; }
Replace:
if($tp) { print &FilterPNTF($tp); exit; }
*edit3*
Then find
print "$ThisHTML";
And replace with
print &FilterPNTF($ThisHTML);