You have a very slight chance of such thing happening. And the password is encrypted in the cookie i think so you cant just see exactly what it says.
---------------
About the param and option thing:
{param} is what goes inbetween a bbcode tag. For example:
text
text would be the param.
{option} is what goes near a = sign. For example:
SomeText would be the {option}.
In the replacement box you can use those two things to get information.
Lets use the url one as an example. But we will name it link instead as it will format it into a link if i use [ url ].
In the replacement box you would put:
<a href={option}></a>
But thats not really helpful as there is no text to show where the link is. So we could put:
<a href={option}>{option}</a>
which would give out the following output:
www.vbulletin.com (http://www.vbulletin.com/)
But you dont HAVE to use option. You can use {param} the same way. {option} is basically an extra if you like incase you need a second paramiter.
www.vbulletin.com
Then in replacement box you would type:
<a href={param}>{param}</a>
And you would get the same output as above.
But lets say you want a link but have a "Click Here" link.
Thats easy enough. In the BBCode manager you would put the following for the tag "link".
Replacement box:
<a href={option}>{param}</a>
So if someone put the following:
Click here to goto vBulletin
The output would be:
Click here to goto vBulletin (http://www.vbulletin.com/).
---------------
So to sum it all up:
{param} and {option} are ways to gather information sent by the user.
---------------
I hope this helps you :)