A friend and I run a vbulletin forum which recently got hacked. We believe what wound up happening was the attacker gained access to the VPS box and from there elevated their user accounts to admin status on our forums.

Obviously if someone gets into our box in the future it'll be a disaster so outside of sending backups to outside email/ftp servers are there any ways to secure a directory our backups reside in from a user who gains access to the system such that they're not recoverable or deletable?

The obvious to me way to protect directories from root access is to put them on a separate NFS server and NFS mount them to the machine that needs to use them, on the NFS server you export them, with settings on /etc/exports(8) that denies root access to the NFS client, (see root squashing) which is the default behavior. I am not aware of any way of protecting a local filesystem from the root user. The backups stored in these NFS mounted directories would therefore need to be written to by a non-root user and of course could be unmounted when backs are not running to them.