Quote Originally Posted by savage
Unfortunately these attacks do not use the Administration Panel, as far as I am aware, they are security holes in phpBB and when you pass certain parameters to certain php pages, it executes the SQL statements. That is my understanding of how they were able to hack our site.

Thanks for the suggestion anyway.