Most times people are not "hacking" your website, they are merely using known exploits on certain scripts, or your password is too easy.
Check other websites on the same server, if they are hacked, it may just be that they hacked the whole server and not just your website. If it's just your website, then it's probably an exploit in one of your scripts and / or security is lacking in one way or another
Update:
I wasn't hacked personally.
The whole server was hacked because there was a user on this shared server who uploaded a script that was exploited. All files that had index.* was rewritten including ALL Cpanel files.