The hackers who hacked me did not need to log in, they just knew which php scripts had teh hols and were able to exploit them.