First, if your running Linux or FreeBSD you need to find security expert and do an audit of your servers. Sounds like he gained access through a back door and installed a CGI script to run as root through a web browser or open port.
Second, test your web host and see how easy it is to gain info about your servers with no proof of identity.
If he is really running as root, your problems are bigger then you can imagine. If he does something illegal using your servers you could be held financialy responsible for any damage.
Good luck
