I'm almost certain that there is a vBulletin exploit that the spammers have been using for a while. I don't know if this board has a minimum set, but I don't think it would matter regardless.