it's enough simple, use ventrilo_proxy (
http://aluigi.org/papers.htm#ventrilo_proxy) and connect your ventrilo client to it so that you can see the content of all the packets included the 0x4a one (starts with 4a 00 00 00 and is bigger than 80 bytes so you see it enough easily) which contains the settings of the specified user ID.
so then you must simply edit the settings of a user and checking the bytes which chages, easy :)
note: if sometimes you see garbage/random data dumped by ventrilo_proxy it's enough that you relaunch it, rarely happens