The salty posts about his hosting provider are confusing to me. He is paying $55/month and is expecting aid in forensics and audits? Is that normal for a low cost provider?

Edit: Also it sounds like he didn't immediately shut down the server after the first hack? That is completely insane. I understand you want to investigate but you are leaving yourself wide open leaving the system running. It's been compromised. End of story.