Of course a list of good suggestion so far .
@ GamblerZ : Did you check the Server log ? If you want I can check all the logs of " log access raw " within this 24 hours. ( the time your forum was hacked ) just pm me the log file if you like.
I had 2 forums on Shared servers and it happened the same case but an other forum on dedicated server never hacked! although all of them were the same plugins and ...
see
here it may help you .
one more thing that doesn't relate to this case did you ever use " Separate Sticky and Normal Threads " by any chance ?
--------------- Added [DATE]1231704492[/DATE] at [TIME]1231704492[/TIME] ---------------
oh, I forgot another thing , .. Ask your host : is the phpMyadmin password protected ?