If you have not already done so, you need to go to the relevant
top-level site(s), click Site Settings, Go to Site Administration,
Manage access  Requests and then tick the 'Allow requests for access'
tickbox. I am not sure if this is ticked by default.

Hope that helps, apologies if you've already done that,

But that is done. But users still get the login prompt.

Any other ideas??

Getting prompted three times when someone doesn't have access  is
expected behavior in WSS v2. Getting prompted indefinitely isn't. Don't
know what would cause that to happen.

This will happen if they don't have access  to the Access Request page. We've
had that problem in that past. I *think* it was fixed with a patch, but I'm not
certain. can you verify what patch level your installation is at?

I can certainly see how that would throw you into a loop.

The only other thing I know of that sometimes causes unexpected login
prompts if when I've had pages in a site collection that contain
content (usually image web parts) linked from a different site
collection with different permissions. But not sure how that would
interact with a Access Request. Hope you sort your problem (you have
the Todd's on your side so i am confident).

Yeah, this will do it too. If you think someone should have access  to a
page, but they can't get in, append ?contents=1 to the URL. That'll
take them to the web part maintenance page. None of the content of the
web parts is rendered, so off site links won't screw you up. It would
look like this; http://server/site/default.aspx?contents=1.