Site has been hacked twice now

Hello,
I have a site that was designed using Css Sculpter 3. It was hacked once on October 4th. Today it was hacked again. The first time I didn't think much of it. Someone had inserted code on the index page. Today's hack was a bit more worrisome. What ever their method of getting in, the ending up replacing the blank.gif in the Csssculpter images folder. here: 2ColumnFixedLeftSidebarHeaderandFooter_Pacifica_images

The site is hosted on Godaddy. I called them and of course it's not their problem. It must be something on my site they site. A problem with my code. They told me to change the password and then to buy their monthly website security plan. Wondering if they are doing it to sell me the addon!

I have done tons of sites and have never had a site hacked before so I'm grasping here to find what the cause might be. Are their any particular security settings that I need to make sure are on maybe in the read/ write permissions folder?

Does any one have any suggestions?

I can supply the domain name if need be. Not sure if it was safe to post it here.