I feel like I’m tempting providence, but it seems my site has been sorted out. The hackers had managed to get a secret account on my site, so what ever I did to stop them was useless, they had their own password that let them do what they wanted. My ISP has cleaned that out and I’m resolved not to use free scripts on my site anymore.