Hacker or DB Error

Short summary: the problem described above looks like intermittent MySQL connectivity/instability on a shared host rather than clear evidence of a targeted compromise. @smantscheff and @alc are on the right track — shared servers can exhibit transient DB failures when load, networking, or daemon stability fluctuate. The most useful next step is to collect objective, time-stamped evidence you can hand to iPage so they can (a) reproduce the fault and (b) check the MySQL daemon and network around those times.

Quick, repeatable tests to run now (drop into webroot and run by cron every minute; adjust paths and creds):

<?php
$log = '/home/youracct/db_conn_log.txt';
$ts = date('c');
$start = microtime(true);
$link = @mysqli_connect('DB_HOST','DB_USER','DB_PASS','DB_NAME');
$elapsed = round(microtime(true) - $start, 4);
if (!$link) {
    file_put_contents($log, "$ts FAIL ({$elapsed}s): ".mysqli_connect_error().PHP_EOL, FILE_APPEND);
} else {
    mysqli_query($link, "SELECT 1");
    file_put_contents($log, "$ts OK ({$elapsed}s)".PHP_EOL, FILE_APPEND);
    mysqli_close($link);
}
?>

Also test from a shell (if available) and run traceroute/telnet to check network reachability:

mysql -h DB_HOST -u DB_USER -p -e "SELECT 1;"
traceroute DB_HOST    # or tracert on Windows
telnet DB_HOST 3306

What to request from the host when you escalate: MySQL error log entries for the reported timestamps, mysqld uptime and process restarts, server load and connection-count history, any throttling/connection-limit policies they enforce, and network outages affecting the MySQL node. Ask them whether they enforce limits (max_connections, per-hour query caps) and to search for "aborted connection" or crash messages in the server logs.

If the host cannot provide useful logs or the outages continue, consider moving to a VPS/managed DB or enabling aggressive caching (vBulletin caching / memcached) so the forum reduces DB hits. To rule out intrusion, check webserver access logs and vBulletin admin logs for abnormal spikes, failed-login activity, or unfamiliar admin accounts before assuming a hack.