I know your tuner issue was not hack related but I'm very surprised no one asked you to run the netstat command via a telnet session but instead said pull the network feed ?.
For the record if you ever see a tuner in use and suspect it has been commandeered fire up a telnet session and run the netstat command. This will tell you exactly what is connected to your box via the internet and list the IP address. You can then take action instead of pulling the network and waiting for it to happen again.