Bringing it down to basics... if the HTML is changing and there is no other methods to change it dynamically (no web forms, databases, etc.) then they're probably being uploaded with the changes. So definitely change your passwords for FTP, Cpanel, etc.
As well, I would check with your host to make sure you don't have any issues with your .htaccess file (like referrer hacks happening).