Listen, first of all try to remember if you have installed any 3d party modules, which may be the cause for the backdoor.
I see that your site is empty, so you can delete everything and reinstall it (best suggestion). For me it's obviously that someone just got your password. Did you remember to set the permissiong of config.php back to 644?
When you reinstall your website make sure to create a new mysql database with a new user with a new password etc....
Now that you have reinstalled everything (don't update from old tables yet, some of the old information there in the settings, like old passwords may be a key) you can do two things;
go to your server, and check webstats - you will see a list of ip's that have visited your site. Now considering there weren't many visits' you can check one by one to see what kind of ip's were visiting you. You can easily identify google bots and such (use
www.dnsstuff.com and
www.ip-adress.com).
Secondly, you can install a module which shows you who have been visiting you while you enter the administration panel (you can download it from php-mods official website).
My suggestion to you, if you want to catch him/her/it/them/us/whatever - leave everything as it is and let him play with your website. Try to update, change passwords and see if he still hacks it. Meanwhile go to your webserver and check the ip statistics. This person will probably enjoy playing around with you so his ip will be the one that you will see the most. Then just call his internet provider and your issue will be over.