Sorry for the late reply, I was in Hong Kong for the weekend.
I am thinking they must have gone in through the Control Panel since they changed my password when they were there.
I don't have phpBB on my site and my other scripts I am pretty anal about keeping up to date. It was kind of rude of them to delete everything in my root web directory, but they are turkish script kiddies, so there is no accounting for manners.