Something like this:
Captcha On Login - vBulletin.org Forum
IP banning isn't entirely reliable. There needs to be a way to knock everyone offline and log in again with the captcha. Set a limit on number of attempts.
BTW, some other sites that use vbulletin are still vulnerable to the Google hijack.