I'm still investigating the site defacement / spam emails that were sent last night. I've been on the latest version of vBulletin, so I'm not sure what happened.
What I know:
-- It seems to have been vBulletin specific; nothing on the main site was touched.
-- Once into vBulletin, they replaced all of the templates with their garbage and did a "send message to all users" email.
-- It's all been cleared out. I erased all files, reuploaded, restored all templates.
-- Passwords are safe. vBulletin automatically salts and encrypts them, so even when this kind of thing happens, they're safe.
I'm very sorry for the troubles. I've done a few more things to better secure the site (beyond what even vBulletin recommends), but I'm still digging. I hate days like this.