My forum (SMF at the time) was hacked years ago via a 0-day exploit in SMF forum. The hackers just uploaded popup advert html and images to the forum and served it out to victims. There was nothing I could have done to avoid getting hacked, it was a security hole. It wasn't hard to clean up after upgrading.
My friends' forum (still SMF) more recently got hacked with a far subtler hack. It was hacked via an exploit in a mod, not the main forum software, and the hackers modified the forum software to show content about erectile disfunction and redirect users arriving via Google to a dodgy online shop selling prescription medicines like Cialis, but the dodgy content and links were NOT shown to users, only to Google bot. So ordinary users didn't see anything wrong, but searches online for the forum on Google were essentially being stolen and redirected.