Nathan built it.
Ive spoken to my web hosting company, they seem to think as it's a Wordpress site that its more vulnerable to attack than other sites as theyre the most popular kind of site. Bit like why Windows machines are attacked more often than Macs.
Its most likely they got in through one of the pages that has a contact form embedded in it. So, they've been taken off for the time being. Thing is my mail server is totally blocked up with a queue of mail as a result of spam email being sent out from the site. I cant receive any email now on my default email as its all getting blacklisted. Have to sort through that somehow, not sure how, Ill be speaking to the hosting guys again soon.
Ive got 24,000 pages to delete, which they've uploaded, Im halfway through, but can only delete 100 at a time.