I've had exactly the same problem, DavidAllen.
My index.php files have had code injections of pornography and pharmaceutical links exactly how you described.
Support have assured me before that its been fixed, but yesterday my index.php was wiped and new links injected.
I was told the attacker IP has been blocked from the server, but I don't think this is acceptable (for the
website hosting to be hacked 2 or 3 times).