Spoofing is the most popular way of hacking vb boards. The best protection against this that I know is to make sure that you and your staff NEVER log in to your site following a link that someone else entered into a message. Also do not allow your staff free email addresses like hotmail as they can easily be accessed to retrieve mod and admin passwords.