found the problem.
VB has some sloppy code. i check the membergroupids in the vbulletin DB User Table and there was a group ID that was an old one, that doesn't even show up in the usergroup manager on both vbulletin and photopost. Of course that wasn't in the noshowgroup so 30k people with that number in it had access.
I think you should redo the restrictions so that rather than using a noshowgroups ID, it should do a showonly groups ID.
That way guys like me running 5 year old vbulletin don't have these little problems
The reason this happend was because I used the User promotion in Vbulletin to upgrade certain users after certain years to a new group. I'll have to submit that bug report to them.