Every think is fine on server end. I have had a security company investigate this and they say its an exploit in the script. My server is fully protected.

Also my site is hosted on a completely different server to my hosting.

And a member of staff has confirmed that the holes in the script are fixed.