So I'm going to keep this short, generally vague and to the point.

The PDM users were deleted through the user manager by a PDM member who already had access to the user manager. Here is what we found:
- On Monday morning, a IP that resolved to a proxy logged into the suspect member's account several times.
- During this period, a new user was created by the suspect member's account with the name "plowie".
- Several minutes after the "plowie" user was created, the suspect user's account logged into the PDM Boxcar site using the typical, normal IP that is logged daily.
- Directly after that, the same IP (non-proxy) logged into the "plowie" account.
- A request from the suspect member's IP was what triggered the deletion of all the users.

The member claimed that he didn't accidently do it or anything like that and said he was sound asleep at the time it happened. I can't really speak to that, but I can say that the request to delete all of PDM's users originated from a machine on his network, so there's no hole in Boxcar or anything like that.

I'd like to think that this member didn't do it (or at least didn't do it maliciously...) but for that explanation to hold water, the member's computer was either a) hacked, or b) used by someone else in his home.

Regardless of how it happened, I restored an older list of users and permissions so the damage is relatively minimal minus having to rebuild the accounts that were created in the last few months. The biggest thing to take away is that Boxcar is fine (minus having the ability to delete all members... but this was a shortcoming in GT too, which I replicated successfully!). If anyone else has any relevant info they'd like to share, please PM me on the forums and I'll try to get back to you when I can. :)

PS. Thanks to qz for his assistance grabbing the logs and looking through them with me :)