Forum Just got hacked
 

Somebody just delete one of my moderators and got in to another moderator account. I have look in admin log and it is not done from my account or another admin so it means it has been done from database. I don't know how does it happened so I would like to hear something from you. Also, I have backup from today so my question is can I copy that user from user table in DB and import it back to live DB. Will that bring him back and connect to all his previous posts?

I have change info of database and passwords but I am afraid he will done it again.