Wait, how often does your Wordpress site get successfully hacked like that?
One time the hosting provider got compromised, FTP server exploit IIRC, they ran a recursive search and replace from root directory of the server.
Back around 2010, there were security vulnerabilities in WordPress or its popular plugins almost every month.