To change your php files, you need ftp access to your server which you cannot get through q2a software as far as I know. So maybe somebody got/stole an ftp login of yours?
What is your server log saying? Is there a bunch of php file accesses in the logs?
I am not an expert, just some thoughts.