Support

Even if it was a perfectly clean Joomla! installation, it is possible to be hacked from the "back door" if you're on a shared host. Some ways this can happen:
- Permissions alone don't mean much. It's the combination of permissions and ownership which can protect your site. If your site's files and/or folders are owned by the user Apache runs under, your site is by definition insecure. Any other site on the same shared host will be able to modify your files or write file to your site's folders unless your host has given 0700 permissions to your home directory. Most hosts, even some very high quality ones, don't do that.
- Depending on the permissions/ownership combination, it is still possible that a compromised account on the same server may be able to read your site's files. If you have enabled Joomla!'s FTP layer, therefore storing your FTP password to your configuration.php file, an attacker could read the file and gain FTP access to your account.
- If you or your client are using FileZilla, it is possible that malware on your computer accessed the plain text (not encrypted) password storage file of FileZilla and the attacker gained FTP access to your site. The same thing goes in case you are infected with a keylogger or other monitoring malware.
- If you or your client connect to your site's frontend, backend or FTP from a public location or from a compromised Wi-Fi connection it is trivial for an attacker to steal either the login information or the login cookies.
- If you have Joomla! 1.0.x, 1.5.0-1.5.24 or 1.6.0-1.7.2 and an older PHP version then your site is susceptible to a very disturbing hack which allows an attacker to override the password. In this case, you absolutely need to upgrade to at least Joomla! 1.5.25 or 1.7.3 which solve this security issue.

However, I tend to think that Brian is right and you have most likely some leftovers from a previous hack. Please note that it's not sufficient to scan the core files against a stock installation. The hacker may have put new files or modified files in other extensions as well.

Some site unhacking and protection resources:
- Unhacking Your Site by yours truly
- Help my Joomla web site has been hacked!! by Brian
- The standard instructions given in the Joomla! forum. I would like to specially stress that Security Checklist 7 is of paramount importance. I would like to, however, note that instead of merely taking your site off-line you should use Admin Tools' Emergency Off-Line Mode. Joomla!'s off-line mode is not really off-line.