[Dismounted]

Then you have a problem if they can inject MySQL, and if they can do that, you'd better start worrying about your whole database, not just your passwords. The exploit probably comes from a vulnerable modification, I suggest disabling all of them until you find the culprit. You seem that you don't know how serious such a vulnerability is.

You can't match such hashes against a dictionary list. I don't think any dictionary has lists of 35 random characters and their non-hashed equivalents...It is true you can do that with single MD5 hashes, but the system vBulletin uses cannot be matched up (easily) with rainbow tables. There is no easy way to "decrypt" hashes, as all hashes are designed to be "one-way". They are normally cracked using rainbow tables, or brute-forcing, which cannot easily be done with vBulletin hashes.