Originally Posted by VRPdommy

While not spending much time looking/thinking at this since I have enough management problems of my own, I would say...

If you are looking at the php output and looking for the source of bad html output, look also at the theme and plug-ins. They can overlay anything anywhere since it is all php.

There are sftp programs that will let you look inside of all files for matching strings of code automated. Makes it easier but does take time. Better than by hand/eyeball.

Originally Posted by VRPdommy

If you determine you have been hacked, I would say stop doing things in a/the standard way.
Your making it to easy.