And I assume the same thing for each usergroup?

Yes, HTML is disabled in all usergroups as well.

And you have went through all the php files in your forum root, and there is nothing there that should not be?

Have you changed all passwords for all admins, FTP and capnel if not it needs done. The next step is to hire someone to find out how you have been hacked

How about any erroneous cron jobs? ACP --> Scheduled Tasks --> Scheduled Task Manager

I ran Maintenance > Diagnostics > Suspect file versions and checked every file that had a notice. Aside from some older files from previous versions of VB and old plugins, nothing was out of place.

I replaced all VB core files with fresh downloads, and replaced most plugin files as well.

Sucuri and ClamAV didn't find anything either.

--------------- Added [DATE]1407701446[/DATE] at [TIME]1407701446[/TIME] ---------------

Those all seem to be ok as far as I can tell. There's a couple from mods and the rest look like core VB tasks.

I'm not sure anything would appear in the access logs, but you may want to look at and sort by the modified dates of any files (not just vbulletin ones).

Why are you on 4.2.1 and not 4.2.2

It was due to incompatibility with a mod I was using. I'm no longer using it and will be upgrading, but I don't think 4.2.1 PL1 -> 4.2.2 PL1 fixes any security issues.

Looks like you may have to resort to paying to have it sorted. :(