I found some malicious code in one of the .js files inside one of the plugin sites, deleted it and the font has been restored.
I have changed all passwords for everything - ftp, wordpress, databases, etc. It is not deterring this person from accessing the site. Things are disappearing, moving, changing. It is horrible. I"ve reinstalled wordpress in a subdirectory with a new database for testing, still the same thing.
Today the Appearance > Edit link has disappeared, the footer on the main website has also disappeared. The text slider in the header no longer works. And I have not touched code since Friday night. :-(