Hi,
I would love to assist with resolving this issue, I am a security focused, computer and network engineer with a huge amount of experience with web hosts, web sites and site compromises. I am available to start looking at this immediately and should be able to get this resolved but the end of the day.
I would need a lot more information about the site and preferably access to the host its self, tho I know that is not always possible.
Typically once a host has been compromised the hackers will modify existing files or upload new files to create back doors or phishing sites etc. the trick is finding them :)
Kind Regards,
Jeff Carr