It sounds like a group of people abused the Social Group feature of vBulletin[1] to piggyback off of his forum to have their own little area without having to host their own forum/server. Depending on how vBulletin is configured, you can basically create a wholly independent forum within the Social Group that can't be accessed/seen outside of the group.
Yup, I believe that's what they used. It's a documented feature, but one that I was completely unfamiliar with. I also opened registration, but wasn't monitoring new signups.
There wasn't any harm to it, but it's definitely something that can slip by an insufficiently wary admin.
[1]http://www.myth-weavers.com/wiki/index.php/Help:VBulletin:So...