Yeah don't pay him squat, you obiously had a security flaw in your website because 99.3% of the time its someone that hacks your e-mail sends a reset password and gets in that way, otherwise you used a script or something that had a exploit or he brute forced attacked and got your password.
Mod_Security for Apache I think handles most stuff hosts normally have it installed for their sake. Restore your backup, but run a viri scan or check for things that are odd. Reset your password for your scripts, and use a different password that has Q@#$^&#*$#*#%$^@$%@ stuff like that in it for your e-mail so people can attack it. Up_3r&#&^@# stuff like that works good.

Edit: Get the raw access logs or last visitors and try and find his IP Address!