How to avoid script being injected into costum blocks?
So if your admin account had it's password changed, I would be willing to bet the hackers gained access to your admin account somehow. 

Might want to think about beefing up your passwords, for both your admin account and the box.

You definitely should make sure your Drupal install is up to date. If "Drupal Core update status" isn't "up to date" at /admin/reports/status you should look to update core. If there is ever a security vulnerability found in core, it's normally fixed very quickly and rolled out in a new version, so you should keep your core up to date. 

As for ways to make your blocks more secure, one thing you might want to try is to actually move the block from being controlled by the admin to being controlled by code. 

You can write a little custom module that will create blocks. You'll want to be familiar with hook_block_info and hook_block_view. Another upside to moving blocks into code is that it will increase their portability. 

Also, as another general security note, you might want to take a look at Security Review, which will help point out any security flaws you might have on your site.