Proof?
Just because he logged in under different names doesn't mean he knew the passwords. vb has mods to let you log in under another user, but doesn't mean you need the password. When you log in, all it does is hash the password, compare with the hashed one that's in the database, and if it matches let you in. Mod just tells it to ignore the password and let you in anyway.
No professional forum saves passwords in plaintext, and md5 is not reversible.
all i know is that someone logged into my yahoo account and changed my password. no one knew that password and i don't answer phishing emails and shit like that.
I took someone's password by simply answering their security questions.
It's possible if he re-coded the forum to store the passwords plaintext, but he would have had to do that when it was first set up -- before he had any idea people would act like they did. It would have been more trouble than it's worth, also.
Not saying it's impossible, but I highly doubt he'd go through that much effort to take your yahoo account, and he would have had to change the forum software before it was updated from SMF or else nobody's password would have worked.