My website got hacked second time in a week

[zczfwz]

The web hosting emailed me about my site got compromised and sending spam email and having phishing redirect to steal people PayPal information.
This is the second time in a week and they said if it happens another time, I'll loose my web server.
There were some file got injected into my Joomla root folder. Including /match/index.php, /chs/chs/auth/, /member and so on.
After the first hack, I have deleted all the files in Joomla root folder and uploaded a version from one of my old backup. I thought it should be a clean version, but just after a couple of days, they mentioned my site has been hacked again.
I know I haven't been updating the Joomla version and extensions versions. I'm now creating a new website with the old database but with latest Joomla 3 version, and I will keep my extension up to date. Hopefully it can be more secure.
I'm just posting the FPA, hopefully you pros can find out what could be the explosion for the hack.
Thanks in advance.

[sozzled]

I know I haven't been updating the Joomla version and extensions versions.

Have you learnt anything from this experience?

I'm now creating a new website with the old database but with latest Joomla 3 version ...

You are aware, of course, that this approach probably will not work? You can't just "take an old database" that was compatible with an older version of Joomla, tack it onto the "latest version of J! 3.x" and expect it to work as if nothing has changed. It just won't work; it's as simple as that.