I'm pretty sure that vb passwords are MD5'd, then salted and MD5'd again.
It's likely that they got the hashes and the salts, but it's extremely difficult to work backwards to discover what your plaintext password is... that is, unless you used something stupid, in which case they can work forwards from a list of bad passwords until they find one that matches your hash.