not sure what exactly happened, but somehow the site was compromised. I basically took the database at it's current state and restored it into a fresh vbulletin instance and ran an update to vb4. Not sure if one of the admin accounts got hacked, but everyone should change their password.
Things missing:
-uploaded attachments
-avatars (just reupload)
-chatbox - got this sorted for now... depends how ya'll like it