travellers on "Latest WP but still hacked with RFI"

Well yes I can follow that. My machine comes back clean, and I'm guessing my host isn't responsible since it was him who discovered it and notified me. I've changed all my passwords across the board, cpanel, wp admin, etc. And I can restore backups of the files and the database.
But none of that does anything about how they got in in the first place. They certainly didn't guess any passwords - none of those is less than a dozen characters that are all random symbols. I'm running the latest version of WP, all my plugins and theme are up to date. If I can't close the back door, all I'm doing is rearranging deckchairs on the Titanic - the hacked files will be back next time the hacker's bot stops by!