Typo patrol:
Going by your detailed description of the many things
that the intruders
changed and broke, it may be way too late to figure out for sure what
the avenue of entry was. However, if you really _were_ running a
15-year-old Linux kernel, then don't forget that the public attack
service includes the network stack -- and CVEs for the kernel get
^^^^^^^
"surface"
ignored for 15 years at your peril.