Yep, what should have been done if you absolutely had to know how it happened (not that bad an idea but for smaller places they don't have the time or money to

Yep, what should have been done if you absolutely had to know how it happened (not that bad an idea but for smaller places they don't have the time or money to do it) is take a disk image of the compromised system for later analysis. For right this second, get the site back up on a clean, updated install. You can not trust the existing one now, don't even try. EDIT: BTW this is also why you should be backing up your data and config files, not a bare-metal image of the system. OS installations are quick and the bare-metal image is just going to put the problem back in place. Remember, you probably do not know exactly when the break-in actually occurred.