Yes, our forum is still small because we havn't got the mainpage up yet...
What's your php version? If it''s lower than 4.12 you should consider upgrading to patch that security hole. Also, are you sure he doesn't have direct access to the database? This is most likely because than he wouldn't have to go through the control panel... You really post this problem at the
vBulletin.com forums, they could probably help you more.