WordPress hacks are common and frustrating. There is obviously a vulnerability that is allowing them access. Most likely this is through a plugin.
To answer your questions:
Have you used anything like Sucuri or your hosting service to scan for affected files? Check to make sure there are no unexpected administrator users - I would do this in the database rather than in the WP dashboard.
You are getting it because people want to send your visitors to their site which may be advertising or malware.
To prevent hacks you need to eliminate all those vulnerabilities. The first thing to do is remove all unused themes and plugins. Then reduce the number of plugins to a bare minimum. There is often a temptation to install every plugin that you think would be fun. Don't do it. Avoid the temptation. There are regular events where websites have malware code injected into them and it invariably is done through a vulnerability in a plugin.
Anyone in the world who knows how, or thinks they do, can write a WordPress plugin. I have one myself available in the plugin centre. And that is my point. What do you know about my programming skills? How secure is the plugin? How trustworthy am I?
Think of it like like inviting a total stranger to add a room to your house and you have no idea whether they may either deliberately or accidentally not put a lock on one window. Someone not very nice discovers this and goes around looking for all houses where that person installed a room...what could possibly go wrong?
So do install plugins, but;
- only use what you really need to
- check out how many stars each plugin has
- when was it last updated?
- is it what looks like a reputable company or just someone with a good idea
- keep your ears open in forums in case someone has had trouble