If this is magento enterprise check the admin actions log to see if a specific user is adding it in.
Consider changing all passwords for admin user accounts, server access accounts, check the server out for any backdoors/malware. See if any users are logging onto the server via ssh at times when you don't expect someone to be connecting.
I'd advise to protect your users/customers you put your site in maintenance mode until you have resolved this.
Check you have all security patches applied, as Maikel has said use magereport to get an idea of what is missing (if any)
You really need to audit your server