Hackers can sabotage phpnuke 6.0 thru webmail module

[azmipelah]

I just got my access log file reading and I was surprise that someone has using my webmail module and attachment files into machine....strangly my webmail module was not activated by me...
the hackers try to use the following url

http://mydomain///modules/WebMail/mailattach.php?

could someone try to solve this bug...at the moment as a procaution measures, I have deleted the module webmail in my module directory...

[azmipelah]

the url(correction)

http://mydomain//modules/WebMail/mailattach.php?

[chatserv]

In PHP-Nuke 6.0 as long as the mailattach.php file is on the server even if the module is not active you can get hacked, the fix is to either delete the file or upgrade to 6.5