A few more notes:
-- It was indeed all done via vBulletin, and not directly on the server. This is slightly good news in midst of it.
-- They came from two IP addresses in India. I've banned the entire range (59.95...).
-- They didn't send very many of their email messages. I can't get an exact number, but it seems to be about 5,000. That's certainly a lot, but just a fraction of our 100,000+ users.