Securing My OSCommerce Sites

A while back I had a series of OScommerce sites built for me by a freelancer here. Any Tom Dick and Haryy could access the admin area of the sites by accessing the /admin folder. As the sites were dormant, this issue was not addressed and payment had already been made. But today I was informed by Paypal and Ebay that at least one of the sites have been hacked and have been sending out phishing emails and phishing web links to gather credit card details from unsuspecting surfers. An email sending script was even installed on one of the domains. There is no way for me to change my log in details to the admin areas on the sites. I am also concerned that there are security back-door flaws through which these sites can be continuously hacked and used for mischief. None of my non-OScommerce sites have ever had this kind of problem. This is to get someone that knows that an OScommerce site is more than being about pretty design that can go over them to ensure that I can log in and log out of the admin area and that it is no longer open to any one to access. There are four sites in total. There is no design involved in this project. Just to take care of the security issues that were neglected during the original projects (they were all done by the same provider so it goes without saying that the same faults exist across the board although I have only been alerted about one hack).