Emails from "Anonymous" - All appear to be from sites running vBulletin

[Kesha]

It appears as though there are multiple reports across the internet that users are receiving emails that appear to be from websites they've registered for, but bear no relation to anything happening with the website. I couldn't immediately find anything about it elsewhere. Here is an example that I found by doing a Google search of certain lines in the email.

Taking a look at the headers of these emails, The X-Mailer is "vBulletin Mail via PHP". Is there anything currently advised that would enable someone to compromise this many websites and send these spam emails? If there has been anything, I must certainly be oblivious.

[Zachery]

If they've gained access to the file system, or database, it wouldn't be hard to use the mailing functions. There have been security isuses over the years and anyone running a legal, or illegal version of the software that isn't patched, or has an exploit from third party software, could be abused.

[Kesha]

I actually found a thread on here dating to the 11th of March. Thanks for the pointers anyway.

[Alfa1]

Its easily possible that these sites have open relays. this allows bots to send spam through vbulletin sites. Open relays are often caused by addons and wrong settings. Most admins have never heard about it.

[Munkholm]

My 4.1.11 forum just got hacked. All requests are forwarded to http://jforjustice.co.uk/banksters and they have been using the mail system to send out mails exactly as the above...

The host is restoring a backup as I type this, but what can I do to prevent this from happening again?

[Alfa1]

First you need to understand how exactly they gained access to your server / admin panel. Then close the vulnerability. This may be a matter of server settings, worm infections, addons, or even an unknown vbulletin exploit. You will need to find out.

[TheNewOne]

first thing I would do is change all passwords