dewd I feel for you
a month ago some guy from denmark came across my subscription website and found vulnerabilitys in the database and code.
He actually extracted 5 user names/ email address/ and passwords from my database as proof that the DB was not secure. He works for a company called hackavoid(dot)dk
He offered to secure the site for me for $200 and is currently doing it. I told him to send me a report on what the vulnerablilitys were and what he did to fix um.
Like me, unless you know how to do website security on your own you are pretty much at the mercy of the guy that knows more then you (hacker).
I would suggest you...
1. backup your data right now
2. hire a professional to secure your website and lock that mofo out for good.