You should look through your access_logs to see how you were hacked. If you don't know where those are you should contact your host immediately to get them since very often the hosts will not keep them for long and if you wait to contact your host, you may not get them.