This invention relates to elevator systems, methods of operation thereof and software for the control thereof for reducing the risk of injury to a person gaining unauthorised access to the top of an elevator car. Although modern elevator systems include a large number of safety systems to prevent injury to users or service personnel, there is an ongoing drive to reduce further any potential risks for injury. The inventors for this invention have identified a risk of injury to a person who gains unauthorised access to the top of an elevator car. In present standard elevator systems movement of the car is immediately stopped by the so-called safety chain if any landing door is opened other than by the car door when the car is at the landing. However, the inventors have realised that in this case normal operation of the elevator would resume automatically once the landing doors were closed again. Thus a person could gain unauthorised access to the top of an elevator car by means of one of the landing doors and thereafter be able to ride illegally on top of the car (commonly known as "car surfing") once the landing doors had closed again. Whilst this poses a moderate risk in elevator systems having overhead space at the top of the hoistway, it poses a great risk of severe injury or death in the case where little or no overhead space is provided at the top of the hoistway as is becoming increasingly common. As well as the risk of such an illegal surfer being crushed between the top of the car and the top of the hoistway, the limited overhead space means that the safety balustrade must be retractable and thus if it is not deployed there is an additional risk of the illegal surfer falling from the top of the car. It will be appreciated of course that this risk is increased since the car will be traveling at full normal speed in this scenario rather than at the slower speeds associated with proper inspection mode riding of the car. The inventors have further appreciated that one way to overcome this problem would simply be to modify the safety chain or a similar system operating in tandem with it to latch into a non-operative state should any landing door be opened other than by the car door. This would then require resetting the elevator system by an authorised user. However, the inventors appreciate that this arrangement would interfere with legitimate inspection and maintenance by authorised personnel who require access to the hoistway. In particular it would increase the time necessary to carry out a brief visual inspection of the hoistway from outside. It would significantly increase the time taken to perform safety verifications prior to authorised inspection riding of the car since these would involve having to reset the system several times. It is an object of the present invention to alleviate the problems set out above. When viewed from a first aspect the present invention provides a method of detecting unauthorised access to an elevator hoistway comprising receiving a signal indicative of a landing door opening, determining whether a door of an elevator car arranged to move within the hoistway is closed and if the car door is determined to be closed, determining whether the load on the car is above a predetermined threshold and if said load is above said threshold, suspending normal operation of the car. When viewed from a second aspect the invention provides an elevator system comprising an elevator hoistway connecting a plurality of landings each of said landings being provided with a landing door, an elevator car arranged to travel within said hoistway, the elevator car comprising a car door, means for generating a signal in the event that one of said landing doors is opened, means for determining whether said car door is open and means for detecting a load on the car wherein said elevator system is arranged such that if a signal indicating that a landing door is open is generated and the car door is not determined to be open and said car load determining means measures a load above a predetermined threshold, normal operation of the car is suspended. When viewed from a third aspect the invention provides computer software for controlling an elevator system comprising an elevator hoistway connecting a plurality of landings each of said landings being provided with a landing door, an elevator car arranged to travel within said hoistway, the elevator car comprising a car door, said software comprising: logic for receiving a signal indicative that one of said landing doors is opened, logic for determining whether said car door is open and logic for receiving information relating to a load on the car, wherein said software is arranged to suspend normal operation of the car if a signal indicating that a landing door is open is received and the car door is not determined to be open and said load on the car is above a predetermined threshold. Thus it will be seen by those skilled in the art that in accordance with the invention if a landing door opening signal is generated when the car door is closed i.e. a landing door is opened other than by normal operation by the car door whilst arrived at the landing and a determination is made that there is more than a given load on the car, normal operation of the car will be suspended. The car load threshold would normally be set such that it will be exceeded by any person on top of the car. It follows that in accordance with the invention if an unauthorised person has gained access to the hoistway via one of the landing doors and attempts to ride on top of the car, normal operation of the car will be suspended thus removing the risks associated with riding the car at normal speed and possibly without deployment of any safety devices. As explained earlier, this is of particular benefit in elevator systems having little or no overhead space at the top of the hoistway. In the situation set out above, it is preferred that normal operation of the elevator car may only be resumed upon a manual reset by an authorised user. Most preferably such a reset must be performed from a point out of the hoistway accessible only to such authorised personnel - e.g. a room or cabinet housing the elevator controller. The system could be arranged to prevent any movement of the car whilst normal operation is suspended. Preferably, however, operation of the car in an inspection mode is permitted in this situation. It will be understood that this would be subject to the proper procedure for entering inspection mode being followed and any necessary safety devices being employed. In accordance with the invention, normal operation is not necessarily suspended if no load is detected on the car. This is beneficial since it allows a legitimate service engineer to access the hoistway via one of the landing doors without having to reset the elevator which commonly requires walking to the controller at the top or bottom of the hoistway. As well as visual inspection of the hoistway from outside this also means that safety verifications which are made prior to an engineer riding the top of the car without having to perform multiple such resets. Typically such safety verifications comprise operating the top-of-car stop and inspection mode switches separately and verifying that normal operation of the car does not take place. Of course, absent this feature, reset would be necessary before each of these verifications could be carried out which could make preparing the car for inspection operation a very lengthy process. In accordance with the invention however, a significant reduction in servicing time may be achieved without compromising safety. In the above situation suspension of normal operation may not take place at all or, in some preferred embodiments, may be delayed for a predetermined time to allow the aforementioned safety verifications to be performed and/or to allow a quick visual inspection of the hoistway from outside. Even in accordance with the invention in its broadest aspects, the inventors have identified a further special case in which it might be possible for an unauthorised person to gain access to the top of the elevator car and to "surf" the car operating at normal speed. This special case arises where the car is properly stationed at a landing with both the car and landing doors open but where an unauthorised person simultaneously opens another landing door - e.g. at the landing above the car - and thereby gains access to the hoistway. In accordance with at least some preferred embodiments of the invention however the elevator system or software determines whether a second landing door is open if the car door is determined to be open when a landing door opening signal is received. If it is determined that a second landing door is open, normal operation of the car is preferably immediately suspended. The elevator system correspondingly preferably comprises means for determining whether more than one landing door is open and is arranged to prevent normal operation of the car in the event that it is determined that two or more landing doors are open. As previously, it is preferred that normal operation of the elevator car may only be resumed upon a manual reset by an authorised user. Most preferably such a reset must be performed from a point out of the hoistway accessible only to such authorised personnel - e.g. a room or cabinet housing the elevator controller. The system could be arranged to prevent any movement of the car whilst normal operation is suspended. Preferably, however, operation of the car in an inspection mode is permitted in this situation, subject to the proper procedure for entering inspection mode being followed and any necessary safety devices being employed. Such arrangements as are discussed above are novel and inventive in their own right, whether or not the load on the elevator car is detected and thus when viewed from a further aspect the invention provides a method of preventing unauthorised access to an elevator hoistway comprising receiving a signal indicative of a landing door opening, determining whether a door of a car arranged to move in the hoistway is open and if it is determined that said car door is open, determining whether a further landing door is open and if it is determined that two or more landing doors are open, suspending normal operation of the car. Thus it will be seen that in accordance with this aspect of the invention, the special case identified by the inventors whereby safety systems might otherwise have been circumvented is prevented. No limitation as to the order in which the determinations are carried out in the above method should be implied. For example, the initial landing door opening signal may include information as to whether it is one or more than one landing doors which are open. The features mentioned above are also preferred features of the first aspects of the invention. Simultaneous opening of two landing doors may be detected by any convenient means. In accordance with preferred embodiments, different signals are generated by the opening of doors at different landings. This could be such as to give a different signal for each landing but the inventors have appreciated that the situation whereby an unauthorised person may gain access to the top of the car arises when it is the door of the landing above the one at which the car is stationed is opened. Thus in preferred embodiments, different signals are generated by the opening of landing doors at odd and even landings so that if the odd and even landing door signals are detected simultaneously, normal operation of the car will be suspended. Many different arrangements for determining the load on the elevator car are well known to those skilled in the art. For example, a strain gauge may be used to measure the deflection of elements whose elastic deformation under load is related to the load in the car. The load weighting device may measure the load under the bed plate of an elevator machine, the load in the rope dead-end hitches, the load under the car platform or the load on the elevator ropes for example. Similarly, many different ways of detecting opening of the car and landing doors are known to those skilled in the art. For example, any one or combination of micro-switches, optical detectors, magnetic detectors or pressure sensitive switches may be used. Certain preferred embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings in which: Fig. 1 is a flow chart showing operation of an elevator system in accordance with a first embodiment of the invention; and Fig. 2 is a flow chart showing operation of a second embodiment of the invention. Turning firstly to Fig. 1, in the first step 2 a landing door opening signal is detected. In the next step 4, it is then determined whether the car door is closed. If the car door is not closed, normal operation of the elevator car is therefore permitted at step 6 subject to other safety systems such as the safety chain. If it is determined that the car door is closed, the load on the car is then determined at step 8 by means of a signal from a load weighting device. Any load weighting device known in the art may be used. If a load above a predetermined threshold is detected, normal operation of the car is suspended. The threshold could, for example, be set at a few kilogrammes to avoid spurious detection but to ensure that any person riding on the car will be detected. Although normal operation is suspended if an excess load is detected, operation of the car in inspection mode is permitted subject to the correct procedure for entering inspection mode being followed and all of the necessary safety devices being employed. In order for normal operation of the car to be resumed, the elevator system must be reset by operation of a manual reset in the enclosure in which the controller is located and therefore accessible only to authorised personnel. If a landing door signal is received, the car door is determined to be closed but no load weighting device excess signal is received, normal operation is not immediately suspended such that a full reset is required. Instead there is a delay sufficient to allow an engineer to perform verification of the correct functioning of the top of car inspection mode and stop switches by operating each in turn and checking that the particular switch in question prevents normal operation of the car. The delay would also permit a quick visual inspection of the hoistway when from outside without the need for the system to be reset thereafter. After the delay normal operation is suspended so that only operation in inspection mode is permitted until reset. In an alternative arrangement normal operation might not be suspended at all in this situation. Fig. 2 shows the operation of a second embodiment of the invention. This embodiment is the same as the first embodiment except that in the event that a landing door opening signal is received at step 2 and the car door is determined to be open at step 4 the controlling software makes a further determination at step 14 as to whether there are landing doors open on two levels, (odd and even numbered floors). If it is not determined that two landing doors are open, normal operation is permitted in step 16. If, however, it is determined that doors are open on odd and even levels, normal operation of the elevator is suspended until manually reset from the controller enclosure by an authorised person. Inspection operation may be permitted if the correct procedure for entering inspection mode has been followed and the relevant safety devices have been employed. It will be appreciated by those skilled in the art that the embodiments described above are merely exemplary and may be varied in several respects without departing from the scope of the invention. For example the system might be arranged to detect simultaneous opening of two landing doors with measuring the load on the car.