Roger i have a question
what sort of forum are you using.
i had the same problem on an other server with the smf forum they got in via the forum and then injected all simular files with url’s and some other s***
FsPaint shop was hacked a few months ago, I used E107 then, they got in threw the contact form.
I just switched forums, deleted the database and directory for the old.
Kesuk, I have no idea but it was hacked twice.. My host told if the contact and registration pages aren’t done correctly it can be a problem.