vBulletin Hacked Accounts
 

I recently found out that someone hacked accounts from members on my site. I also found out that all these accounts were registered on another, small site. ( so it is very unlikely a coincidence ) The hacker was admin on the other site for some time, before being banned. How could he have stolen passwords on the other site? I have admincp info to the other site, but i don't know what to look for.