I know, it's very strange. And it seems like it would be easy to find.
As for .htaccess, I can't find one unfortunately - that would have been too easy.
For your second suggestion, alas, I already over writ the entire forum directory, so no evidence remains. But since the hack is still there, I don't believe it's actually in the files themselves. I still think it's a database thing.