Forum hacked - how did they get my password?

[محروم.كوم]

Hackers got a back door to our server for months until we closed it today. In that time they got the password of my account - the main admin one. How could they do this? I thought passwords were encrypted and unobtainable. I changed my password several times yet they still used my account. They did upload a file pass.php which was always deleted after they finished, so we don't know what it did. But it couldn't decrypt my password, could it?
Note that they used my account despite me changing the password several times.
Obviously this is of great concern.
We are running 3.8.2. __DEFINE_LIKE_SHARE__