Add a shirt is also switched off (not sure if that was your doing or part of the hack). could it be possible someone has injected some php code into a shirt description that is then being pulled up when viewing the home page showing the most recent shirts and rather than printing a description...
I have just looked at the site and noticed in top left corner it says I am logged in with an account name mark.sh***ey@im***dia.com and as at the bottom it says site copyright improdia I am guessing there is an exploited admin account somewhere. What software are you using for the site?
edit...