Oh.... Wow...
That's... Not good.
The only unfortunate thing is that they aren't showing you anything from the error log, which I would guess now means that there's nothing showing in the error log... which means timeouts, and code errors.
Their notes at the end about the developers mxing live and dev databases is also very concerning. This should always be separate... I don't know what they were thinking doing it like that!
But above all, this is what concerns me the most:
It might be an idea for the devs to install Wordfence and run a check of all files to ensure the hacks of the parent site haven't propagated into the test site - just a thought.
So, I take it to mean that they've been actively developing a new site on a server that's experienced a hack, and have even used the same databse? Is that correct?
If it is, fire them straight away. Not kidding. That's the most stupid thing that I've heard for a long time. There's no excuse for that lack of security. As the hosting company said, thehacks may have spread to the new site, which could very easily explain why there's that trouble. And if the development comapny isn't smart enough to be able to see that I would never trust them to get a site that's anywhere near secure in the first place.