Comment Oppurtunity left on table (Score 1) 19
Aside from injecting some PHP code, why not make db changes as well? Surely a bit harder for most people to detect and especially clean up.
Good time to leave GoDaddy for sure though - if they aren't keeping up with WordPress patching, they probably aren't doing too great with OS patching either.