I've read several exactly same stories (CSS stripping prog.) on slashdot.
I say dump your current host.
WHAT THE FUCK?
Why didn't THEY bother to check it first? Don't fucking pass the buck.. YOU're the service provider.
P.S. Welcome to
The Corporate State.