You left root login enabled and kept passwords on. And you're upset you got compromised? You can also enable keys in the control panel and you won't have to deal with passwords being emailed.

Those are the first few things you should be checking when setting up a new server (disable password logins and only allow keys).