The "Lock control panel against opening from within IE" setting can be bypassed in IE7 by using IE7's Tools->Phishing Filter->Phishing Filter Settings.

I tried reporting this to Microsoft, but they said it was a SpyBot problem instead, and told me to report it here.