Most times when people say their Joomla website has been hacked, the security problem has nothing to do with Joomla itself. In most of the cases, the hacker came in through an unsecure third party extension that the site owner installed.
Check this list for vulnerable 3rd party/non Joomla! extensions.