my sites was hacked once, some bad guys deleted all my products images,
for i bought a theme without checking upload permission, they upload a backdoor file then get all admin privilege
please also check the web server(mayb apache log of this website) ,especially the POST action lines,
there may be some information showing the backdoor files,