If you're using the default skin that comes with the software, then I recommend seeing if any of the skin templates have been altered. Also, check the various 3rd party apps you have installed (if any) to make sure that they are legit. It's quite possible that something is happening internally (not guaranteed, but better to check and be sure). If the skin is a 3rd party skin, ask the author if they'd be willing to examine the skin to see if it's been altered in any malicious way.
Assuming that everything is clean internally, it's time to look outside of the IPS suite. Have you installed anything else on your domain that isn't party of the suite? Subdomain, another URL for a different type of page, etc.? If so, check the contents there to see if anything has been maliciously added. If not, then you may need to contact your hosting company for assistance in figuring out how someone was able to install malicious code on your site. There could be a security update they need to install or a setting that needs to be changed.
Before doing ANYTHING though, download a full backup of EVERYTHING! (Full database and all the files for your website.) This will serve two purposes. One is in case something more goes wrong, you can restore and retry. Second is that you could provide the files (and/or data) to someone you can trust to look through and see if they can find anything malicious.
Better safe than sorry!