How can they be using it if it is not allowed? Did you disable it in your vboptions - disable bbcode? or what? What is the exact code they are using - ?
If so, you can make a plugin just for posts and replace [ img] with [ code] and also [ /img] with [ /code] (no spaces).