If he keeps putting some update.php file on the server, then it sounds to me like he has ftp access to your site. You should change your passwords to logon to your server. Is this the only site on the server? If other sites are there and have modifications installed, maybe he is somehow using one of them to upload the file? Sorry, hacking isn't my expertise, but I would definitely start by changing all passwords and making sure the admin cp is htaccess protected.
When you say you keep installing the style again and again, are you putting up your own style, or the vbulletin default style?
Also, have you read this?
http://www.vbulletin.com/forum/showthread.php?t=194701