WordPress installation sends out spam email

Hi all, I was recently contacted by my host telling me that my wordpress installation is responsible for sending out massive amounts of spam. It’s caused by a file called config.php which has nested itself in my /wpcontent/ folder. Upon removal of the file, it returned the next day.

My plugins are up to date. WP is up to date. My theme is profesionally made and up to date. How do I stop this? Any help would be appreciated.