Yeah, once I turned off the refresh redirect I could see they had more access than just posting a message.
I expect there is a way to change the password directly in the database, so that would be the next step. Either your hosting company or vbulletin support should be able to help.
It sucks having to deal with this. Good luck!