The character limits for usernames, though... smells like a SQL injection issue. Which is an obvious and completely naive thing to assert but they're using PHP so my immediate thought is that they're passing raw userdata into the database as strings.
That was my first thought too. I'd guess that it's a vulnerability somewhere in the code for handling the forums.
I would be willing to bet that they could get rid of a lot of the attack surface just by using standard services for certain things.
Although judging by a screenshot of the recent hack[0] posted here[1] escaping (and XSS) may not be an issue.
