It seems your Magento setup is still compromised at some point so you should carefully check Magento + Webserver settings.
You cannot trust your installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new host with the latest backup before you shop was compromised.
If this is not possible due to various reasons, you might check/do these things related to this issue:
Remove all detected changed/hacked files plus installed extensions
Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).
Remove created backend admin accounts
Especially for SUPEE-5344, there will also be an admin account created in the backend. Remove all new/unnecessarry admin accounts.
Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database.
Check file/folder permissions
Did you check your file/folder permissions?
There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.
Check server logs
Check your webservers access/error log to trace accessed sites and suspicious URLs.
Maybe you find suspicious IP's to block on firewall level.