Aegir and SA-CORE-2014-005
If site 1 and 2 are compromised, it's entirely possible that
sites 3 and 4 are either in danger of being compromised or have
already been compromised.
More or less, yes. If they already have sites 1 and 2, it's extremely likely that they can directly access your server.


You should consider your current server and the sites running on it as tainted and rebuild from scratch. Despite @Clive's assertion, there is no user account sandboxing happening at the per-site level.