The quick and dirty of it... It's a combination of many factors but the three main ones are...
1. There has been an increase in forced public indexing of the site in Google/Facebook/Twitter recently...
2. It's a default vBulletin install, thus it's easy to single out in a Google search as a forum to spam...
3. No moderation cue or delay, or at least one that is not actively monitored...
It comes with the territory, you want exposure you get it both good and bad exposure...
The spam can be controlled and severely limited (even on an open forum) but it requires several modifications... The easiest way to to start is to re-organize the script, I don't know vBulletins current licensing agreement so you might be limited, in fact I would bet it is, but in short when you have a ".../register.php" file on your website and a "Powered by vBulletin" at the bottom of the pages (I believe this tag is part of the licensing agreement and can't be removed), it begs to be exploited by automated spam indexers and crawlers...
A Google search for
register filetypehp "Powered by vBulletin"
will give you a never ending list of links to vBulletin boards to join and spam, a search that exploits the default install of vBulletin (aka a register.php file and the 'Powered by vBulletin' tag on the page) making it easy to identify as a forum in searches...
The easiest quick fix is the put 'newbie' accounts in a post moderation cue for a period of time, meaning they can post but the post won't show up until approved by a moderator... Thus you catch spammers and disable accounts before it hits the forum... An annoying thing to implement for the newbies but a very effective filter...