Have you contacted godaddy about it? It sounds like he has root access to the server therefore can simply cd into your (or anyone else on that shared server) docroot and change whatever he wants.

Tell godaddy to secure their server or switch to a better host.

ive asked them, they simply said:

The compromise of your account is outside of the scope of security that we provide for you. Virus scans are performed on the content that is hosted, but they may not pick up everything, largely due to the fact that hackers tend to upload custom scripts which are not picked up by traditional malware scanners. However, if a virus is detected, you will be notified.