As many commenters have pointed out performing and "upgrade in place" has it's dangers. Malicious code can come along for the upgrade ride, but simply starting over with a fresh install is not enough. Malicious code could easily hitch a ride in the files folder or in the database and survive the upgrade process. PLUS this diagnosis of not upgrading in place doesn't address the initial hack at all.

The point of this article wasn't to discuss all of the technical methods of dealing with a hacked a site as much as it was to outline the human elements that lead to the initial vulnerability. If we as service providers can better educate our clients about ongoing maintenance costs and clients can insist that they have a maintenance agreement with their service provider then both parties interests are aligned with long term security in mind.