Holy shit. That ought to ratchet up the paranoia a notch or two. Did you use the same password for your website and this site? That could explain how they got in. Never use the same password for multiple sites fellas.