You need to review the logs line for line. See if anything odd happens. Keep an eye on strange requests, especially by the same IP(s), especially in the photoplog directory. If you find a suspect IP run it trough vbulletin and see what comes up. You need to find out what services where exploited and if you can block these services, or at least make them more secure.
You should be able to access your logs trough your servers admin panel. Where in the admin panel depends upon which admin panel you have.
Hi,
I have plesk running... where should does logs be ?