Redesign implemented and some additional coding for my church website + determine how they are getting hacked

My church website is done using smarty templates. They have various admin functions, like editing pages, setting pages under various categories, etc. They want a new look and have come up with a design they want to use. I need this new design to be implemented, and I also need for a few minor changes in functionality. In addition to this (and, to start off with, before anything else happens) I need to know how they are getting hacked. Every now and then, in the admin section, I am getting a new page created by someone.