Daniel Larson has been sending smoke signals for the last week about using the RunWithElevatedPrivilege (RWEP) method. He finally goes into further detail today with his cautionary tale and a recommended SPUserToken work-around.

I have seen several programs that use RWEP to accomplish updates on behalf of a user. (In fact, I use the method in the Image Upload Web Part.) In this circumstance Daniel is advocating using impersonation via the SPUserToken for the "System Account." I believe this to be sound advice and will be updating my code accordingly.