The only way people can "Hack" your server is if:
1. You have a password that is easily guessable.
2. Gave your password to someone who wasn't trustworthy.
3. Have RCON enabled and have your rcon password somewhere people can access it.. such as a publicly shared server or accessible through web somehow.
4. Have an addon with a known exploit that someone is using to elevate themselves to admin.
Here are some suggestions on how to harden your server installation.
1. under NO circumstances EVER use leaked addons. The legality/ethics of that aside, most leaked addons have backdoors. (see #4 above).
2. Minimize the number of addons you are using. This will help minimize the chance of having something with an exploit (see #4 above).
3. Change your password to something crazy hard and don't share it with anyone. Get into the habit of changing your password regularly.
4. If you choose to use RCON, make sure the password is set in your server command line.. NOT your server.cfg config file. Talk to your host about this if you need help. There have been some known exploits in the past that allowed players to gain access to the server.cfg file and therefor the rcon passwords of players who had them stored there.
5. Most likely your issue is a backdoored addon. You'll just need to find that and get rid of it or pay someone to do that for you if you don't know what you are doing.
I wish there was something else I could tell you, but that's pretty much all there is to it.
