Was this 2nd one after you changed your password? Somewhere in your setup you have a security hole, exposed file, permissions set wrong, something.. your webhost should help you with this, it may be a server configuration flaw and not just your site at risk. Start looking back in your server logs, error logs, find out who's been accessing your directories and how. It sounds like one of these kiddies who thinks they're doing you a service by letting you know you have a security flaw
Do a Google search of BenGack, you'll see he got a couple other sites at one time, including a hosting company.