That message is also triggered if certain pages that are not meant to
be loaded on their own if accessed directly.
ie. index.php may load required.php in the background, but if you try to load
required.php outside of index.php, you will get that hacking message. So what
happens is the calling page creates an in memory variable on the server and
if that variable is not found by required.php page, it throws out the hacking message.
Most of those pages control saving and retrieving data from the database and this
prevents hackers from injecting what ever they want into the database. Such as
replacing a downloadable file with a file containing a virus etc.
BTW: required.php Does Not Exist! I used that name as an example.  
