My coworker supports lots of old Joomla installations and they get hacked every other week. Usually the .htaccess redirects people to porn sites or they insert SEO spam. I do t know how he copes with it