I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of our members use that single username.
Yesterday while we were surfing the web (checking mails) using that VPN connection someone hacked into our mail account, fortunately he was a white-hat and he told us there is a problem in our VPN server.
So if the hacker could connect to the VPN using that single username, is it possible for him to sniff all VPN traffic? Or is it more likely that he hacked into our mail account using other ways? We are really confused because the only way we could think of is that hacker has a full control over our server.