A common password, and especially one that is sent out by mail, is always less secure then an individual users password. Just because of the fact that more people know it.
Im still using the permission system, so its protected by their account pass, plus the forum pass. So a little extra security. I think that they get these other peoples passwords through other members on other forums, matching usernames etc, you know they can log passes on forums. So they just use that to access I guess. My vB is fully up to date security wise.