Bottom line, he is probably going to have to hire someone to clean it all up and then add some isolation code with some additional tracking. If he hires the right professional he will learn a ton during the process. I would suggest paying extra to the consultant with this in mind. Find a consultant with great communication skills. Sorry you were hacked! (-- Yes, I know I changed grammatical person. --)
FYI: I do not run a business that assists others in vbulletin problems, programming or maintenance. Therefore, I am not saying this for my own benefit.