The exact same thing happened to a phpBB bass guitar forum I was a member of about 15 years ago. The owner just disappeared and we knew the bills weren’t being paid.
Hypthetically, I found a remote code execution vulnerability in that version of phpBB, read the configuration file to get the MySQL details, and then used mysqldump to download the database.
You can find exploits by just Googling or looking in Metasploit. They’re usually pretty simple query string things.
We set up a clone of the forum with a similar name just in time, then emailed the user database to tell them about the new site when the old one disappeared.
Sadly this caught the previous owner’s attention and he sent a cease and desist, despite his version of the site not existing any longer. So, we wiped the database, and then all the users just signed up again. It still lives on as https://www.basschat.co.uk/
Hypothetically.