The very first thing to do it you believe you website has been hacked is to IMMEDIATELY change passwords related to the website. I would strongly suggest that you make new password at least 8 characters long and a mix of numbers and upper / lower case letters. You need to make sure new password is very strong and difficult to guess because it appears that somebody did guess your old one.
I also remember another post where somebody walked away from their computer for a couple of hours without logging out of their web hosting account and a "friend" uploaded a prohibited script resulting in a suspension and account termination. Something else to ponder when reviewing your website security.