First, posting about it in here probably won't help, but it's worth a shot. We're just other users, and have no idea how your site got hacked. However, it's possible that others have seen the same hack, and may know what specific path is being used. But for others to help, you'll need to provide some information about the exact nature of the hack.

Your best bet is to do some Googling about the specific infection, which might lead you to others who have encountered it. These hacks are never specific to Bluehost, so limiting your search for answers to these forums isn't a good idea.

Second, posting the actual code that the hackers have inserted is especially dangerous - you may then be exposing forum visitors to the same infection. So please don't!

Finally, expecting Bluehost to do something about it is misguided, since it is your problem and not theirs.

There are only two ways that an account can get infected:
  • You are running an insecure script on your account that is used to break in.
  • Your computer is infected and they have hacked into your account through your own computer, or by grabbing your password.
Securing your scripts and securing your PC are both your responsibility.

Insecure scripts: make sure you have the absolute latest versions of whatever scripts you're running (Wordpress, Joomla, etc.). Be careful of plugins and addons, which might not be secure (and which don't get fixed as quickly as the core programs do when security problems surface). If a script can't be made secure, you have no choice but to abandon it, no matter how much you love it.

Infected PC: run scans with one or more anti-virus programs, as well as scanning with a good anti-scumware application. You should also scan for rootkits (Google for "rootkit detection"). A keylogger, for example, might be recording every keystroke, so when you change passwords, the hacker is made aware of it almost immediately.

As far as I know, the Bluehost servers themselves have never been hacked. Also, Bluehost makes sure that each account is kept well isolated so that those people who are not careful enough to keep their own accounts safe do not affect those who do.