I’m only posting this because the impossible happened to me today. Running Joomla 1.5 I ran into one of these so called Hackers. (nice try)

Well trying to destroy info and uninstalling of components, I managed to switch the account to suspended.  Buying me enough time to fix this leak. Now not only is this a critical fix released last year by the joomla.org team but a very good lesson learnt too. Learn to back up your websites, db and lookout for critical updates for your Joomla version. (Or even update it)

A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user (lowest id). Typically, this is an administrator user. Note, that changing the first users username may lessen the impact of this exploit (since the person who changed the password does not know the login associated with the new password). However, the only way to completely rectify the issue is to upgrade to 1.5.6 (or patch the /components/com_user/models/reset.php file).

We all know this fix has being repaired in the latest version 1.5.9. But be sure to check your version.(I made that mistake.)
It’s a critical security patch and part of 1.5.6. (read more)