My website was hacked – wp-comments-post.php

My wordpress site, https://steadfastlutherans.org, was hacked yesterday.

My host, 1and1, shut off the site after getting a massive number of spam email reports that originated from my site. Their analysis said that the emails were being sent trough file:

./steadfastLutherans/wp-comments-post.php

I looked through the first page of comments here; are there any other reports of hacking of this file?

Any clue what I need to do to restore commenting to my site, without again allowing people to spam through the site?

The file is the same size as other installations that I have, but 1and1 has disabled the file for now. Comments are therefore disabled on my site.