luceos absolutely, in my first reply I suggested looking at the files within that folder when backing it up.
If it's a new forum with few users it's probably not a big issue to discard the content. But if many users have uploaded avatars, or of FoF Upload is used, it'll be necessary to keep this data.
For the avatars, it should be enough to check for file extensions. Only keep the .jpg files (there shouldn't be any other file extensions under normal circumstances).
If you had file uploads enabled, checking through those files will be a bit more complicated. The first step is to look for and delete any .php file.
Let's hope the server was not actually hacked, but it's best to be cautious. It will probably be difficult to rule out a hack unless the actual cause is found. If you have full webserver access logs and they are not editable by the webserver shell user, looking at those could also help rule out a hack (check for any GET/POST request to a /vendor/[...] file). But of course if a hacker can edit the log files it's no use.
Some further thoughts about the file content "fileKey not found in session", could this be a bug in the web FTP software your hosting uses? Did you try to edit or move files around using the web file manager? (assuming there is such a feature on your hosting)
I tried doing an exact match search for "fileKey not found in session" on Google, and the 2 results are this discussion and the Flarum discussion index 😅 What a mystery.
