Generally it's due to a security loop-hole, an old version of PHPBBS had the same problem, but was cured by a later update - you also need to remove the offending code from the forums, it's actually stored as part of your forum setup. I've no idea what the flaw actually was?, but it didn't involve someone gaining administrator rights.