Weird he cheaped up on servers paying 55 a month to some random vps provider.
That was his inept deduction that was basically "well, I don't know how they got in so it must be hosting provider"
devil's advocate: is DigitalOcean in this category?
He obviously is more of a software developer than an sysadmin, so maybe it's just a poorly optimized personal app host.