£25 Reward

Right, first I would like to say that MD5 can be cracked, however I don't think that was the scenario here since you are sufixing it with a salt, then adding the password to the cookie is a really bad idea, the username is fine, as it can be found out anyway.

I think they figured a way to send the messages outside the system somehow.

Humm, what steps are you tacking against CSRF? That's when people build their own forms and submit data with their own custom forms and not yours, therefore bypassing a few things that could be crutial and also sending stuff along that could have nasty effects, I'm actually developing my own way to prevent this that will involve checking for referee and generating a form token then when receiving data I would compare the token, meaning whether it came from my form or not, this is very important, you must make sure people submit data with your form only.

Nothing of any value came from the logs.

I think someone found out my password and wrote their own scripts to send SMS messages.