First off, I would go ahead and change your password, just in case someone has it. Next I would go ahead and download a security plugin for your website. Try searching for "Better WP Security" and installing it. Finally, I would head over to your hosting and double check on your file permissions.

Settings should be:
Folders 755
all files 644
config file 600

joe ferdinando on the forum was actually just talking to me about this the other day and told me if you run a quick install from your hosting, those file permissions are not set for you automatically.

I would go with clean installation here. Probably your theme is hacked, and you can't know if hacker left backdoor somewhere, so the safest way is to delete all (except database).

You can follow this steps:

1. Write down all plugins, and active theme
2. Download your wp-content/uploads folder. Scan it with antivirus, make sure those are the files you uploaded (mostly will be images only)
3. Delete all
4. Install new wp
5. Install all plugins and theme
6. Upload "upload" folder
7. Open wp-config.php and replace user and database with the old database.

Site will start working. This way you'll have all new files. Do also what dbong suggested, chmod files. The only thing here that's possibly vulnerable still is database. I can't guide you through that, how to check it if it's ok (make sure there's no false users / admins or so), and check this links:

FAQ My site was hacked « WordPress Codex
How to Find a Backdoor in a Hacked WordPress Site and Fix It

You could also install few plugins like better wp security, or similar, some of those should have db scan option.

Good luck.

Try these two plugins, https://wordpress.org/plugins/wordfence/ to scan your site and prevent future exploits.
If wordfence misses the source of your problem try this one
WordPress › Anti-Malware (Get Off Malicious Scripts) « WordPress Plugins