viewstatemac has been the default since 2.0 as far as I remember but check your web.config and make sure you see

enableViewStateMac="true"

As for the testcase you describe, it's not a CSRF - dotnetnuke has a custom rule set in the friendlyurl that any url that ends in logoff.aspx will redirect to the logoff page. This page does not need to do a postback as the user has clicked log off (or gone direct to that url) to get there, so CSRF checks are not relevant here i.e. the page would need to have a further link saying "are you sure you want to log off" that postbacks for the check to be made - or in other words a user would have to do 2 actions to logoff.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

Yes, if this hadn't been reported as a fixed issue, I would not have posted it to the forum.

UPDATE:
Further intrustion tests now been performed and I'm happy to report that DNN now has a PASS regarding this test, ie it does not seem like CSRFs are possible (at least not in the test cases used).