When a hacker gains access to your FTP account, he can manipulate file structure, access and phish-out your database login details.
S, he may delete the wp-config.php so that your login will not be authenticated.