How redundant should backups be?

[TacticalNuke]

I have a multi-part question about back-ups:

1. Assuming all my attachments are in the database and not kept in another folder, same with avatars (I've never had to move a folder during an update to get images, so I'm assuming they are) is there any need to back up anything other than the mySQL database?

2. I run a cron job backup script every night which puts a mySQL backup on a folder in my server root, then another job to rsync that backup folder with a separate host an hour after that. Is this enough redundancy for a worst-case scenario, or should I set up an automatic sync with my home computer or some other backup solution?

3. If, hypothetically, someone hacked into my account on my shared server, couldn't they get the key generated to rsync into my backup on the separate server, or am I missing something?

Thanks for any help.