12
You will need to fix whatever let them in or they will be back. The firewall probably isn't the weak point since they likely came in on a valid port. I do see that the server is broadcasting way too much info about itself (FrontPage?, there is something to look at and fix or dump...).
As you have noticed it isn't a weakness in XOOPS but further back in the server. The versions I can see are fairly new (unless they just updated...) of the parts I know about but the FrontPage module is something I would stay far away from.