Are you running php 5.3.7 by any chance?
This version has a bug in the encryption function, which could result in the following behaviour if i do understand that bug correctly. Whatever pw you type in it sends the same value (salt) instead of the encrypted pw. I also don't know if the encryption algorithm used by vbulletin would be affected by that.
Information given here (i googled a random english site, read about it on a german one).
http://www.v3.co.uk/v3-uk/news/21035...-bug-discovery
Anyway just a guess. It might help.