He used a bot. Pretty standard. So once he has an acct on the site, they essentially simulate the entry into the form and post it. Forums all have typical URLs (each with their own) so its not that tough to create the necessary scripts. Once you're a member, you can see the member list for the purposes of sending a legitimate PM - note that is PM, not email. They will only get your email if you actually respond to the email.

Now that they have been banned, they can no longer send these messages. One thing that I did forget to do is reset the web server, if their session is still active, it may still permit. I'll do that after submitting this post.