I fixed this and it will be rolled into Q2A 1.6.3. Change the return line in function qa_html_convert_urls(...) in qa-app-format.php to:
return substr(preg_replace('/([^A-Za-z0-9])((http|https|ftp):\/\/([^\s&<>\(\)\[\]"\'\.])+\.([^\s&<>\(\)\[\]"\']|&)+)/i', '\1<a href="\2" rel="nofollow"'.($newwindow ? ' target="_blank"' : '').'>\2</a>', ' '.$html.' '), 1, -1);
It now disallows all brackets [ ] ( ) in URLs.