Basically, I highly doubt that that forum will be secure enough to keep all of that sensitive and private information secure from hackers. It will be a really easy target for hackers to get some easy SSNs and Credit Card numbers to steal.
It is most certainly possible to hack a strong antivirus software. And those software cannot protect against vulnerabilities in software that do not require malware. If he doesn't sufficiently protect himself from attacks like buffer overflows (e.g. heartbleed), sql injection, etc, the best antivirus software will do absolutely nothing. In fact, having antivirus on a server is completely pointless. There is no good reason to have an antivirus on a server since a server should never be running any binary file except for the server software and its dependencies. Nothing else should ever be run, nor can anything else be run if the server owner isn't interacting with server except for site updates. And those should not be messing with the software anyways.