These can be the reasons,
1. An outdated wordpress version which is exploitable
2. The theme might be exploitable
3. The theme owners playing the link game (it happened few years back when a big free themes provider added so many payday loan links to the people's website's footer who downloaded their free themes.)
4. If you're on shared hosting, the server might have compromised that gives the hacker all access to the websites sharing the host.
5. The wp plugins which you installed (some plugins which are nulled) might have malicious code to access your website.
So, get an expert to go through your website and get rid of the hack attempts.