He had no proof aside from "I have found no proof therefore hosting provider must've did it".

Then in his arrogance he thought he's expert enough to "clean" the compromised server even when every security guy will tell you to take the data out and burn it to the ground if there is even a suspicion of compromise.