From a software point of view there's no "original email" address field in the database for vBulletin that I am aware of.
Depending on how it is configured the forum software may send out new user registration emails, in which case your original email address would be in that email if it's stored in an email box somewhere.
You're not only trusting the JREF, you're trusting the server that the JREF is using, you're trusting the company where the server is located (which means you're trusting all the admins that have access that way), you're trusting the internet providers for the hosting company, plus you're trusting all the people who have access to any of hardware between you and the JREF server, since all those people would, in theory, have access to any information sent to the JREF server (including your actual password).
That's true of everything you don't do completely by yourself.
It's like security for your house, there's no such thing as real security. If someone really wants into my house, they'll get in. Do I care if they steal my dishes? Not really. But if I have something I want to secure more I have a bolt down safe or store it offsite.
Same with the forum, if someone with enough resources really wants to get the info they'll get it; god tier security requires god tier money. Any site can only take the appropriate level of precautions given the risk and budget.
If someone gets my real name from the forum, meh. If my real name was so important to me that losing control of it would do real serious harm to me then I would not trust it to the level of security a forum like this could provide.