How much should I charge for fixing it?
Charge for your time is my usual practice.
Is it possible to create and move directories from cpanel just by WP hacking?
If they have been able to upload their own .php files, then they can do a very great deal, they would install their own command interpreter, it will still be limited to the permissions of the webserver, but will be able to create directories, move files etc.
If they have hacked into cPanel, then they could do a little bit more as they can change passwords and more configuration stuff.
You need to assume that they have had cPanel and FTP access, you need to change cPanel password, all email passwords, all FTP passwords. Change database name, database user, database user password.
Are there any subdomains, addon domains or parked domains on the site, rename ALL the "public_html" mapped directories, create new empty ones in their place, now selectively restore files once you have tested that they are safe.