Lots of great talk about things, but i think you're over thinking a lot of things on one hand and missing the expenses on the another.
First off, if you want to provide more attractiveness to the game, you have to provide more functionality to the administrators. You absolutely can't remove what's already available to them because if you haven't noticed, it's why more servers turned into modded ones; the people hosting them want the power to change them. What you see on most servers now is call AA mods -
http://aamods.com/ (it's probably what lead to the army deciding to end AA2 auth as they found a way to hack it) - so you really couldn't make the auth a paid thing if you want this to succeed (that will be tough).
So in hindsight of that, features like the player admin and server customization is going to have to be there if you plan on getting more members to come back.
So now you'll say what about the security issues? Well two things, you guys did have the right idea on the database thing with battletracker, but instead of using it, why not just get a dump of the user names, more specifically the PB GUIDs. Which leads to the next thing, use the PB GUID tracker
http://www.evenbalance.com/ to lock security based on tag and player name locks, so people can't log in using your name or clan tag - and thus not take over your server. The problem is this is a paid service by PB - but you may be able to make a server script that will do the same thing.
Moving forward, in regards to servers, buy a dedicated one. They cost probably 200-400 a month (depending on specs) but you can get like 10 IPs and then sell the service of servers to 10 groups for $40/month of an auth server - with no slot limits. Or introduce slot limits and make a little more.
http://www.gameservers.com/dedicated/ (this is just one among the other many providers out there).
Realistically if you want to reduce load on the auth server then what you need to do is make information store locally on the servers running where the players join and then have them upload that information back after the players session. This means you'd have to configure the server's end as well that are running the AA servers - so that they store the information - which forces everyone to run your scripts or not be tracked / auth. That could be a downside but the upside is then you could make the auth server something simple like a web server that just holds a lot of information and have all the servers talk to it. Or have the servers store the information in a file for up to a period of time and then update the server information after a period of say 5 minutes or 10 minutes depending on the load. Very similar to how battletracker works (just they pull from the actual game and the game servers - you guys would be customizing the game server with your scripts to load straight from the servers.
This may be a smarter way to start to see if people start biting. Just some ideas.