My guess is that he doesn't have access to write/modify/delete files/directories other than his own except directories with permission of xx7 (777) or files with xx6 (666), else he would have wiped ur system clean already. He either:
has a shell account, which allows him to read files that have permission of xx4 (usually 644) under directories that have permission of xx5 (usually 755).
OR
has written a php or perl script, so he can:
do everything that I just mentioned above plus:
have read access (posibly even write if it's xx7) on directories that are owned by apache as long as apache can execute that directory (1 = execute)
have read access (posibly even write if it's xx6) on files that are owned by apache as long as apache can read that file (4 = read).
So of course, reading usernames & passwords in forums' configuration files and /etc/passwd is not a problem at all.
If you do a ls -ld on ~username/domains/domainname/public_html, you'll see that the permission looks like this:
drwxr-x--- (710)
owned by username apache
which means that apache can read and execute on that directory
I've written a php script awhile ago that can do something similar:
LinuxExplorer (for security reasons, it's just an image, but you get my point.)
.