its privatly run... and operated. (not by me)

just the forums are compromised, the rest of the website hasn't been messed with.
the true admin will probably just do a backup and hope the guy doesn't come back.

we got his ip moments before he deleted all the admins, problem is the ip changes... there are 5 different ip's that we have, not sure if they are all his or not. will a whois work on this type of ip? (i forget the technical name for it, may be dynamic?)

thanks for all the responses so quickly, but im afriad u guys are way over my head on this stuff. the most i can do is the whois search. ill try to get in contact w/ the person who has local access to the box and get him to come here.