Or alternatively if it was a 'system' like Wordpress, phpbb etc, and not fully updated, it's possible that someone exploited a security weakness. Happened to me once before. Turns out it was a really simple change to undo the damage but I still reinstalled it anyway.