contract.call.gas(...).value(...)(...) is a way to add Ether and limit gas when invoking a contract.
contract.call.value(...)() will invoke the fallback function at contract with almost all the gas that the caller has. In a normal call like contract.foo, it is much clearer that untrusted code (foo) is explicitly being invoked.
Here's a glimpse into how the reentrant attack was performed: How was the recursion created that lead to theDAO hack?.