[TheLastSuperman]

One thing we can tell for sure is this, either it was hacked or someone had access and shouldn't have. Anyone work on it recently? Do you have one ftp account or many that you've not monitored in a while?

Do as Lynne said and check admincp logs, server logs, your plugins for any new plugins (admincp log will show any newly added plugins) check all of it until you find the culprit.

*Also ask your host if they run any forms of backups, files (attachments if stored in fielsystem) and ANY database backups? Despite some hosts not advertising backups running I do know some run them regardless... for example Hostgator runs weekly backups on most of its vps and dedicated server - others such as urljet run hourly backups so there might be a more recent version of your database backed up by your host - simply ask to find out.