I had 4 sites with this plugin... is there any way to check if the site was already exploited?

Interesting, but my logs show that Fancybox update was pushed from WP.org (that means it was installed automatically without my interaction). I didn't know about this WP feature, or is it some kind of "last resort" feature that only gets used once in a while?