change the password, then lock the files if its on unix. read up on /chmod/
like go to web root directory
chmod -R 444
you could also at the root web directory run
>find -mtime 48
and it would list all files modified in the last 48 hours, then in essance you would at least narrow down all the changed files instead of having to read all of them online.
you could also copy the whole web directory to a seperate backup folder. then based on the above list of modified files you could compare it against the original
>diff currentscrewedupHomepage.html backupHomepage.html
if you pay a hosting company i would shoot then a email and let them know you think you account if being jacked up, im sure they would have suggestions. they could even look at activity logs.