Agreed that it should be simple, but it seems that there's enough room for error with security, sessions, etc, and enough functionality that needs to be built out that's common (mass email, sign-up email, sign-up verification email, for example) that I'm quite surprised that I'd have to build out my own solution.

I'd imagine a few open-source php classes and one or two standard DB tables would do the trick, and maybe a simple interface for managing users and emails.