[Linda Buquet]

Yikes, I have no idea and have never had to deal with this problem, luckily!

However your host is the one to talk to. I don't think anyone can tell you how they got in without seeing your server set up. But it's your hosts job in part to offer protection and they usually have a security department that checks problems like this.

FYI they would also want to know about and check this out because the hackers could be using your site for behind the scenes stuff that could be putting a big extra load on their servers.