They aren't using your password, obviously. Since it is shared hosting, no doubt someone else on your server (or the host itself) is running a script or some piece of software that has a security hole in it that is allowing the hackers to access and modify the content on the server.

This can happen to anyone on occasion, but your host should definitely have tracked down and resolved the issue by now. I would strongly advise you get a different host, since your current one is apparently incompetent.