SQL injection on custom page

[encryption]

I just had a similar thing happen to me yesterday... I'm scared because it appears like the attacker was able to grab all usernames/email addresses/password hashes for my site. I'm in process of locking the custom code down, and I wanted to bounce this off everyone else. What are the impacts of an attacker actually getting the password hash for my users in a vBulletin 4 forum? I know it's not possible to reverse engineer the passwords from the hash, but what are the chances that the attacker can generate a different password (or similar one, maybe based on the top 100 most-commonly-used passwords) that has a matching hash?

I also don't see the attacker pulling each user's salt from my database, but is it really needed if they can generate a different random string of characters that matches a user's hash? Let's assume user x on my forum uses the same username/email/password on ten forums. Without the salt, does this mean that the attacker can only generate a matching hash to login to my site, but not any other forum? Or would the attacker be able to generate the hash for all forums? I'm trying to figure out the real impact of what they got..

--------------- Added [DATE]1294709907[/DATE] at [TIME]1294709907[/TIME] ---------------

Here's my take at it... what's everyone's thoughts on this?

Best case, they didn't grab all the info they needed (the salt) and they give up.

Realistic case, they run something to generate a matching hash for each user, and they now have a second password that works for each account along with the actual password.

Worst case, they somehow pulled the salt, even though I see no proof of it, and are able to either match all of our accounts to a top 1000 password list. They know a list of usernames/email addreses that are using a common password and can start to target other sites with the same userid/email address.

Unlikely case, they somehow pulled the salt, even though I see no proof of it, ran a random password generator against each one until they discovered the password for every username/email/password, and will target other sites.