Email On Subscription
 

Are you talking about payed subscriptions? Why do you need a password if access is already controlled by the subscription?

A common password, and especially one that is sent out by mail, is always less secure then an individual users password. Just because of the fact that more people know it.

Mind telling how they found out these passwords?

Im still using the permission system, so its protected by their account pass, plus the forum pass. So a little extra security. I think that they get these other peoples passwords through other members on other forums, matching usernames etc, you know they can log passes on forums. So they just use that to access I guess. My vB is fully up to date security wise.