UberMensch - I wouldn't say vb is 100% hack proof so I wouldn't want to rule it out because they have come across very vulnerable holes in the past.
Vanilla vBulletin is 99.9% secure. Not to mention, these "vulnerable holes" you mentioned almost always (1) require an extravagantly outlandish and extreme set of circumstances, variables, and conditions be met for any security breach to occur and (2) are fixed before most of the Internet at large knows they exist.
Having said that, the fault most surely lies either with your server or a modification you've installed/made physically to your vBulletin installation.
I'd suggest that you replace all your non-image files with fresh ones from the vBulletin.com Member's Area.
There is also a feature in the vBulletin AdminCP under "Maintenance" which is called "Check for Suspect Files". Using this, you can see any files whose contents don't match what default vBulletin files should contain and also any non-native files in your forum directory.