I thought I was running my 2820n wifi with encryption but a friend switched on his laptop here and got an instant, unsecured connection to my SSID giving him full access to the Internet & my LAN.
Do I have my 2820n settings wrong?

Firmware: 3.3.3_232201
Wireless LAN Mode: Mixed(11b+11g+11n)
Only one SSID, not hidden
Security Mode: Mixed(WPA+WPA2)/PSK
All other settings as default

In the Station List the 'rogue' laptop appears with the Status Code N (Connecting) although it is clearly very well connected.

The rogue laptop is an aging IBM x24 ThinkPad and its wifi card is a Netgear MA701.
Interestingly, it only gets its unsecured connection under the Netgear Wifi Utility. If this is disabled such that Windows Zero Configuration is is control, only a secure connection is offered.

Does anyone have any ideas?

email support@draytek.com for advice.

Also if you have a windows XP PC try running netstumbler to see what it says

If you dont' have XP see http://www.wlanbook.com/netstumbler-windows-vista/

Thanks for the suggestion.
It doesn't look as if NetStumbler likes my wireless NIC (Ralink 2500) as it fails to find any APs at all.
I'll borrow another NIC & try again.
In the meantime I'll run it past Draytek support.

You could try

http://www.metageek.net/products/inssider

This reports the encryption as WPA-TKIP
If I can get the use of the offending laptop again I will see what happens if I restrict the 2820v's options to individual encryption types rather than enable the full mix.

If you enable syslog on the router to send the syslog to some PC running a syslog program you will be able to see all the security handshake messages, they might give some clues to either you or Draytek Support.