[NeDra]

v4.21 forum got hacked 3 times from raw forum no modification, no addon, fresh, clean DB...

I than look at the log it and pointed toward
/install/upgrade.php

I got curious and went to check how they could manage such a thing...
and to my surprise...

The page ask for the customer number... that fine...
View source code on that page

            <!--
                var IMGDIR_MISC = "../cpstyles/vBulletin_3_Silver";
                var CLEARGIFURL = "./clear.gif";
                var CUSTNUMBER = "XXXXXXXXXXXXXXXXXXXXX";
                var VERSION = "";
                var SCRIPTINFO = {
                    version: "",
                    startat: "",
                    step   : "",
                    only   : ""
                };
                var ADMINDIR = "../cp_admin";

The CUSTNUMBER is the MD5(customerNumber)
And guess what, It can be reversed in 5 minutes from what I've seen.
Customer number are what, 12 symbols A-Z0-9
I guess there even DB that contain all possible MD5 with those values.

So they get my customer number and execute the upgrade script and create a new account from the upgrade script...

Why did you even bothered giving them the MD5 of the answer and the link to the admin control pannel?

So yes, delete your install folder entirely or move it outside of your forum asap.