Wordpress has had and still does have open holes that are discovered all the time.

For the owning a forum, he most probaby knew your password or something then uploading a shell via ajax options in vb to get access to your serve.r

Forums are secure, but only secure as the admin you goto keep them up-to-date and dont install any un-trusted plugins, and some good security on your server