The owner of domain name that's being spammed everywhere and I have finally been in email contact. He thought I was the spammer while I thought he was. But we both came to realize that the truth is that neither of us have been sending out these PM spams. Someone has been spamming links to Zeno's ebook, using my email and my wife's name and email to sign up for accounts. We don't know who's doing it yet, but the spammer's IP is 78.96.82.26.
By my estimate this spammer has hit at least 200 VBulletin forums so far.
Apparently the problem is caused because the default VB installation allows PMing for unverified accounts. This means someone can register using someone else's email, never complete the email verification process, and PM spam the members. Naturally people will assume the spammer is either the person who owns the URL being spammed or the owner of the email account used to register. In this case neither of those are true.
PM spamming for unverified accounts can be prevented by setting PMs to zero for COPPA, Unverified, and Awaiting Verification usergroups. But still a lot of forums are vulnerable to this.
The VB team really needs to disable PMing for unverified accounts by default. Otherwise it can create a real headache for people, such as in this situation.
There's a thread about this PM spammer on the VBulletin forums here:
How is someone sending PM's to my members? - vBulletin Community Forum
At first I thought the spammer was done, since there were no knew verification emails coming to me for that last couple days, but I just got another one now.