[Marco van Herwaarden]

If reinstalling the default style using tools.php solves your problem, then this indicates that 1 of the following is happening:
- The hacker is able to change your MASTER_STYLE. This style is only accessible when the board is in debug-mode. Unless you are running in debug-mode, this can only be changed by a direct edit in the database.
- The precompiled cached version of your templates is edited. Again this can only be done by direct editing of the database. The problem gets "solved" when the cache is rebuild (like is done when using tools.php).

Both of these scenario's require that the hacker has direct access to your database, so i would start by focussing on how he gained access to your database and close this gap. You might want to contact your host about this.