[aepiepaey]

The first time might have been forgivable, but with the second incident it was definitely time to change provider.

The conclusion for what happened is obvious: the host "patched" what the attacker had done, but not the vulnerability that gave them access. Thus, the attackers re-used the same attack later to re-gain access.