I had a quick look at the validation link you provided. There is already a fieldset surrounding the hidden fields. But one hidden field is twice in the code, one before fieldset and one after, remove the first from the template (the name=eZSESSIDnetmakin input field) and I think it should validate.
Thanks for your reply, bisk. Actually, what you saw was me half way to fixing the problem (which I've now managed to fix entirely).
What was causing it was a combination of an anchient PHP bug (http://bugs.php.net/bug.php?id=13472), and the form fields being surrounded by div tags instead of fieldset tags.
I solved the problem by replacing the divs with fieldsets, and putting the following into my .htaccess file: