Eric Schmidt wrote:
It was my config.php file that I left wide open :'( when I was working on the site.
Installed a back-up
Everything is working
Changed all passwords
Hope this is the end!
such an easy and costly mistake - i make it all the time
luckily - no one seems to be arsed hacking me 
suggest you make *atleast* weekly backups (daily if the sites busy) - if you host the server yourself - there shouldnt be any problem with that