I have headless miner running on smos.
Every hour some hacker closes my mining session, and starts mining to its own pool

I have been debugging around, here are some facts

*changing user and root password did not help
*changing ssh port did not help
*hacker does not change cgminer configuration, I can just see that it has started mining litecoin, but my configuration stays the same
*he added one item to crontab, that sends emails about my ip to his mailbox every 3 hours, removed that, still gets in to my machine

any suggestions how to block it? considering that I still want to access my machine from internet.