Clay suspects that the hack might have occurred due to the root user being logged into the server. They identified pages on the website through which the hacker might have gotten in, and are considering kicking out the root user to prevent future hacks.