Yikes scary. Thanks so much for your quick replies!
To their defence, they didn't know about the hack. I didn't know it was kept in the same location so thought it was irrelevant. (dumb me) But they have received that email so should know about it now and are hopefully sorting it out. I haven't heard from them yesterday so hopefully they are working on it.
I'll give them one more chance as they have been amazing up until now. Done so much great work on the site I'm otherwise really impressed with them and don't want to lose the relationship. Hopefully they can nut out the issue.
Do you have anything I can send to them that may give them a clue as to what is happening? Where they should start or check?