Spam emails maliciously sent from php script in my forum

[Finn_958]

Hi,
Forum is www.coscienzamaschile.com
Since yesterday I continue receiving abuse reports on the email associated with domain BUT run by Protonmail, apparently because of pharmacy spam emails. The provider ifastnet blocked email scripts from their servers but told me that hackers may use other malicious php code to send emails from my website. My DNS are with Cloudflare and point to Protonmail but complaints go to host ifastnet.
I have no idea why this is happening, is there any solution apart building the forum from scratch? For example detecting the malicious php?
If I have to redo from scratch the forum, what happens to database (users, posts etc.)?
Restoring a backup may fail as it happened in the past
I performed an online scan with Sucuri and Kaspersky, no malicious software was dectedt nor blacklists.
Thanks for your help

[Kindred]

If you need a clean set...


BACKUP BACKUP BACKUP

Delete everything except
Settings.php
Avatars directory
Attachments directory

Reload forum files from the large upgrade archive
Run repair_settings.php to remove mod hooks
Reinstall custom themes
Reinstall mods

[Illori]

https://wiki.simplemachines.org/smf/How_to_upload_a_fresh_set_of_files

[Steve]

This bears repeating:

BACKUP BACKUP BACKUP