2. There was a hacking attempt and the hacker edited the admin area authentication logic of the login script, in order to be able to bypass authentication requirements.
3. It seems to us, that this is clearly an inside job, as nobody else except our host has the main root password.
5. To fix this we have encoded all files on server and changed our root password, and informed our hosting provider if this happens one more time, we have to move away.

You are
sure that your hosting provider is behind the hacking attempts but you are staying with your hosting provider?
If there is any significant evidence that your hosting provider is attempting to hack your site then the only prudent course of action would be to move to a different hosting provider. Period. To even consider anything other then this is just gross incompetence.