It sounds a bit like the site owner was playing wack-a-mole for three years when he should have just wiped out everything. Once you have an intrusion, unfortunately you can't trust anything that a machine has access to and you should start again from a totally clean install. If this was a huge corporate network I could understand that may be impossible. But for a small shop with a few people, there's no reason not to go around and just wipe out every machine in the company.

If this was a government sanctioned job, though, I imagine they could have stepped things up if the script-kiddie stuff didn't work. Why bring out the nuclear weapons if bottle rockets are doing the job just fine.