So it appears I still haven't figured out the security flaw, and it appears several different hackers have all abused it to get to SoR lately. This most recent hacker somehow managed to use four different IP addresses simultaneously during the attack.
I can only do the clean and IP ban technique until I figure out the flaw and patch it
Looking at the logs, SoR is being heavily hit by hundreds of automated attacks daily . . . nothing I can do unfortunately.
As for bookmarks, I apologize but the latest virus clean required me to replace files. Not sure which file I replaced that broke bookmarks and it'll take me a few days to find time to fix it.