If this user had FTP access, they could have easily compromised other accounts, or promoted another account. To see what he did, you could review /noncgi/banlist/adminlog*.cgi and see what has been done, assuming you have the logging enabled.
Switching a public forum to private doesn't delete the files in the forum. If you switch it back to public, the posts should come back, assuming they didn't have FTP access.
