.htaccess

I wouldn't even use password login anymore but use SSH keys with password, much safer.

Maybe your personal PC from which you access the server has a trojan or something, so the hacker has gotten your passwords some how.
Or he gotten in via a malicious script or leak script on your server.

Best is to update everything and also install things als chkrootkit and Maldetect.