Joomla site hacked - please clean and secure -- 2

A website using an old version of Joomla (1.5.23) has been used send out spam and is currently suspended. I have pasted the hosting company's response below. I require someone to check, clean and secure the site - and check the processes of our staff updating the site - and reassure the hosting company so that the suspension is ended and the site can go live again. Future jobs, to be listed separately, will include an upgrade of the site to the latest version of Joomla, moving content and users alongside updating any necessary extensions, and design work to install and adapt new templates so that the website is mobile friendly. There are, in total, four sites in need of updating in this way. Thank you - Nick The hosting company says: The account listed above has been suspended as one or more email accounts within it have been compromised and used to send large volumes of SPAM (example attached) using your own username/password for the account shown in the example. This is due to an attacker who has been able to compromise your email account(s) using one of the following methods - a) Your email account username and password was stolen by malware directly on a computer used to login to your email account(s) (this is the case in 99% of situations like this). b) The password set on the email account was weak and has been brute-forced (this is not possible unless the account had a 4-character password or similar, as all email accounts are protected against brute-force attacks). c) Your cPanel account password has been compromised and the attacker logged in and reset your password for that email account (this can only be the case if you can no longer login to that email account once the account is unsuspended). d) Your cPanel account password has been compromised and the attacker logged in and created their own email account within your cPanel (this can only be the case if you didn't create that email account yourself).