If nobody is having any luck with using telnet (from IE type
telnet://192.168.1.254 (enter) user/pass admin/admin wan proto pppoe userpass (username) (password)) or SNMP as mentioned previously in this thread then here is some information that I've compiled regarding the feasibility of flashing the Billion 7300G using a JTAG cable.
Here is a reference design for a Trendchip TC3162 based router which shows the pinouts for the JTAG signals or possibly header if this is included on the 7300G PCB.
http://bu1.taicom.com.tw:8080/Server/rd/Web_rd/%B1M%AE%D7%2FTrendchip%2Ftcb3162l-e02-v22b.pdf
Look for the JTAG pinouts on the lower left side of the TC3162 on Sheet 1 (TDI #26, TDO #29, TMS #30, TCK #31), the JTAG enable jumper J400 on Sheet4 and also the header pinouts on Sheet 5 J510 header (#3, #5, #7, #9). You may need to solder in a suitable header if one has not been installed on the 7300G PCB (see the HairyDairyMaid Instructions for details) alternatively you may need to make connections to traces or components that are connected directly to the relevant pins on the LQFP (not directly to the chip!). This picture shows the idea although hopefully one can improve on the soldering.
http://rs381tl3.rapidshare.com/files/91817089/P1010053.JPG
Look at the HairyDairyMaid Instructions for details on how to construct a suitable cable paying careful attention not to exceed the maximum cable length.
http://www.zero13wireless.net/wireless/APs/JTAG_Tools/HairyDairyMaid_WRT54G_PDF.pdf
Unfortunately this JTAG programmer was designed specifically for Broadcom MIPS based processors but it may also work for Trendchip MIPS based processors. If not you may need to modify the source. Unfortunately there does not appear to be much information available on the Trendchip TC3162 but you could also look in the source code for information about the onboard flashing routines of the 7300G at the Australian Billion site. This link might also be useful and also Google.
http://forum.openwrt.org/viewtopic.php?id=11038
If you can get the software to function the idea would be first to backup the cfe.bin, nvram.bin, kernel.bin and wholeflash.bin files and then to look for certain names or passwords to see that the backup procedure is working correctly. Take a look at this link for ideas on how to read the contents.
http://forums.whirlpool.net.au/forum-replies.cfm?t=896070
You could then start by attempting to rewrite just the username and password in the nvram.bin file.
More information on JTAG cables
http://wiki.openwrt.org/OpenWrtDocs/Customizing/Hardware/JTAG_Cable
In the case of the locked Billion 7401VGP, this is based on the Globespan/Conexant Argon 432 chipset which does not apparently support JTAG programming. You could look at Post #6 in this link for ideas on how to replace the firmware. Just remember that this recovery process using the serial console cable could possibly brick the router.
http://www.neowin.net/forum/index.php?showtopic=616770&pid=589175228&st=0&#entry589175228