No, I think you have misunderstood me. This is not getting posted to the forums it is going directly out through email straight off the server.
The person can use VBG to send a mass email to over 765 emails at one time and this is not users that are registered on the web site. This is any email address they paste in.
The person has found a way to use VBGallery as a mass emailing feature on a servers with VBG installed. They are using the server through VBG to send 765 email and more at a time through the server.
You say to Turn off the email to a friend feature. That is a vBulletin feature and not a VBG feature if I am correct, right? Please explain a little bit about turning this off as I cannot seem to find that feature in the VBG Admin section.
Here is a link I found tonight that might also have something to do with this
Exploit in VB Gallery 2.5.1