PAYPAL email has changed to hacker's email

hi, my website is 1.39h, it was been hacked. And payment email changed to hacker's email. Customers paymnet transfer to hacker's accout. We have checked 'Only one admin name and account.' We dont know how does hack log in. We have changed the admin name and email addres, and even login page url. What anything else that we need to check or change?

How can I do and avoid such things happen again.

Thanks in advance.

This can happen from the following reasons:

1. Your store was not originally created in 1.3.9h and was upgraded to that. It is possible that your store was hacked in the previous version and you carried over the hack in the upgrade.

2. You web host may have been hacked, is insecure or has bad security practices.

3. Your store passwords were intercepted by someone if you ever emailed them.

4. leaving backups or zips of your store or database on your web space

5. You custom coded something or had someone code something that was insecure allowing access.

That being said, you will need to click on the "Recovering from Hacks" link in blue above and follow the instructions.