Wordpress Security PRO needed. We keep getting hacked.

We have a wordpress website which will be show to the winner. It was hacked months ago and was sending out spam, so we fixed that hole and updated the wp user and password. It was then hacked and was being used to redirect users from spam to pages selling things. A little less severe but caused us to change DB password, root password and WP password again and updated wordpress and all plugins.... I have been monitoring it carefully and have just discovered some new files that have been uploaded and a new user created. And dont know how! new: [login to view URL] file [login to view URL] file with a whole lot of base64 garbage I cannot understand. -New user created with random strings and a whole lot of garbage as well. I have not given out the root password this time and its confusing and frustrating. I could just delete the new files created like last time which keeps me clean for a couple of weeks, but I have left them and hope a security PRO can come in for a quick look and analysis and assistance here. Would really appreciate it! Im online and ready to go now! Thanks.