Unless your miner is exposed directly to the internet (and that would be a bad idea if it were) then they have to be getting in from some other device on the local network.  Have you looked at the possibility that your computer or internet modem are compromised?  Is UPnP enabled on the modem?  If so disable that shit (and do a reset at a minimum but a firmware update would be better).  You seemed to indicate that you knew the IP of the hacker, it can't hurt to create a firewall rule to block them.