Support

Normally Akeeba Backup excludes its backup output directory automatically. There's a catch, though. If you change the backup output directory and have some old backups in the old directory they are not excluded. Moreover, if you have multiple profiles with different output directories their backup files are not automatically excluded. In both cases you can simply use the Files and Directories Exclusion feature in Akeeba Backup to exclude the directory holding the old backups.

Yes, that should fix it and in fact is the only advisable thing to do. You should never leave backups in the site's root. Someone can easily guess their names and download them. When the backup archives are in Akeeba Backup's output directory they are inaccessible over the web thanks to the .htaccess and web.config files we've put in there.