I disabled new registrations, changed all the passwords(ftp, server, site, etc), added banned ips to the htaccess as well as the software admin. I deleted all banned acvcounts, only kept those I knew.
sorry its been a long week. I just got in from work and after towing a truck with my truck about 50 miles.
must have missed something but too brain dead to figure it out tonight.