Stefan, I can assure you that K2 is one of the most secure extensions ever built for Joomla. 2 low priority security issues that were EVER reported (the most recent 4 years ago) were resolved instantly.

The K2 system plugin is executed site-wide (that's what it's for), so there's a chance some other extension got hacked and that other extension allowed the attackers to upload a file (or files) on your server, which in turn modifies core K2 and most likely Joomla files.

Having all these "firewall" extensions is really not a guarantee that you can't get hacked. Entry points can be small modules or plugins without proper data validation, another compromised site using a different CMS on the same web space as your Joomla site or even the server itself if it's a shared hosting environment.

I would recommend hiring some security professional to troubleshoot the issue.

If you can't find one, you can contact us for paid assistance on the matter using this form: www.joomlaworks.net/support/get-help/contact (just make sure you reference this forum thread)

I meant a security professional that can use your server's terminal to investigate how these replacements in the code occur. And since you use vBulletin, well, it's most likely that this is the culprit.

So I would recommend moving the forum or the site to another system account (on your server) so these 2 sites can be isolated from others. This will make your debugging work easier. Just keep in mind that additional files may have been written inside your Joomla site's file structure and the problem may be hard to spot.