Interesting question. I'm tempted to implement it just to prove that I can.
Basic problem: HTTP is a stateless protocol and the concept of logged-in users is not meaningful.
PHP4 sessions allow states to be saved between connections. If you know how your PHP installation saves those states, you can see how many states are currently been saved. See the manual entry on session_set_save_handler().
If people log out from your BBS, you code should destroy the session. There is a problem, though: People don't necessarily log out. They may just wander off. As a result, you have sessions "active" until their age exceeds the value of SESSION_CACHE_EXPIRE and the garbage collection routine happens to get fired.
Right now my BBS has three logged-in users:
-rw------- 1 nobody nobody 129 Sep 25 19:31 sess_63f133e11b227cc94016c0c4a84fc133
-rw------- 1 nobody nobody 130 Sep 25 16:20 sess_6951c804c122c35f70f94c707dc04b2e
-rw------- 1 nobody nobody 125 Sep 25 19:19 sess_8bc5a3d5d227b251b2c66ffb70c347a0
... according to "ls -l /tmp".