[tbp]

Theres got to be something on the page itself doing it, even if its pulling in code from elsewhere.

The problem with things like this is that although some bits are obvious like your popup message, but other things aren't. There could easily be a backdoor in another section of the site to let them back in, or sending data to a server.

As a result, even if you change the admin page you can' t be sure thats it. Ideally you need to restore the whole site from a backup so you know that there is nothing nasty left somewhere else.