Disable password recovery for mods

[NachoTPAO]

The problem was that some mods/admins used a non existing email, so the "hacker" only had to create it and then use the password recovery function....

And then with the hacked admin he started changing all the staff's emails to ones he controls, to be able to "hack" them later via the same method.

I want to be able to disable the password recovery function for staff members so that he can't use this method.

Also, this is a bit offtopic, but is it possible that he can do an SQL injection or other xploit to gain control of my db if i am ONLY running vB 3.8.7 on my site? Could it be a not-know vulnerablity of vB that only he knows? Because that is what he did some months ago, but now it seems he can only use the method I described above...