Now: Hold your horses - until now there is no evidence that this is a keystroke logger. Lets see what the guy responsible for the project answers first ...
I use and have used in this case AdAware (latest version, up-to-date), SpyBot Search & Destroy (latest version, up-to-date), Microsoft AntiSpyware (latest version, up-to-date) and Outpost Pro firewall (latest version, up-to-date) which all can intercept quite a few outgoing sensitive data and none of them react in any way. AdAware and MS-AS block any program which transmits key strokes (I have tried it) - since this is regarded as one of the most threatening behaviors of a program. My firewall is configured in a way that I have to grant permission for a program to send anything at all to a specific server (not like most firewalls where you ususally allow and explicitly forbid). E.g. when submitting this post, the firewall ask me if I really want to send this to the forum ... It is somewhat of a pia but at least I know what goes out ... and it takes only one mouse click
Thus Project Dolphin must have written a program which is really smart not to be detected by any of the three best anti-spyware programs (I have AdAware and MS AS resident and running).
Since the project has been running for quite some time (more than a year) there should be plenty of time for the anti-spyware-guys to have caught it, especially since Project Dolphin in no way has kept themselves secret.
So: until there is some real evidence of malware, lets not accuse them of anything. They may be legit, and my testing has not shown any evidence to the opposite.
If I am wrong, I will apologize and set the record right. Until then I recommend each and everyone to act as the see it fit and not download the program unless they trust it.
