[KuraFire]

As far as I know, those sites have spent many thousands of dollars on implementing very intricate security systems against this. Personally, I doubt they're really 100% secure (I've yet to be convinced on how you can verify the workings of a compiled object without being able to see the source) but in their case I reckon they're mostly just using systems that have virtually no execution power at all.

Do you know what a BOA server is? If so, that could give you an idea of how such sites are (most likely) set up. Scripts (ie. php scripts and the like) cannot be executed because there is no PHP installed, etc. etc. etc.
By disabling a lot of such things you can dramatically limit what power any malicious file can have. For if a malicious file cannot execute any commands or anything, there's very little remaining that it can do.
However, since you're running a vBulletin forum, likely on a shared or dedicated hosting, meaning a server with apache and mysql and php and god knows what else installed, you don't have that option.

See the problem?