Getting Continuously Hacked, At Wit's End

[محروم.كوم]

Our site is getting continuously hacked by, I assume, some bad guy / guys. Started out with making changes to one of our styles, then after correcting it:

> changing styles and deleting all other styles
> changing styles and deleting templates

I've password-protected the admincp, the modcp, removed all perms from all admins and am about to remove the superadministrator setting in the config.php once I get it back to normal.


The question is, what am I missing?

As far as I can tell he has no server access -- I would assume he would have done much more damage by now. He's getting around our .htaccess (with spoofs) and always performs activities as the superadministrator according to the logs.

I'm getting really tired of 6AM phone calls.

h __DEFINE_LIKE_SHARE__