I remember phpBB having a popular emoticon addon, or maybe arcade addon, that ended up compromising a few of the message boards I frequented in the early 00s. Times never change.
Is being unable to change your email address part of the settings you’re speaking of? I get “This server hasn’t correctly set up email.” when I try to change the email address in my profile settings.