A few suggestions:
1: Change your RCON Password. - This is always a good first step when you think you've been compromised
2: Add a private password to your server. Everybody who wants to play with you will need this password to play in your server. - This can be temporary. Normally after not being able to join for a week or two, people get tired of trying and stop bothering you. Add the following line to your server config:
Code:
seta password "whatever password people will use to join your server"
3: Make sure Downloading is turned off on your server. - It is possible this person is simply downloading your server.cfg and using the RCON password inside to mess with your server. Add the following line to your server config:
Code:
seta sv_allowdownload 0
4: Rename your server.cfg and run it from the startup line. If this person is managing to download your server.cfg file to obtain your RCON password, simply rename your server.cfg to something less-standard like lolmyconfigs.cfg and ask your host to edit the target of your MOHAA Server to load lolmyconfigs.cfg instead of server.cfg
Good luck, hopefully any of those simple fixes help..