If you’re not logged in as the author of the post, you shouldn’t see the ‘edit’ icon.
Check your index.php file and make sure that nothing has been added (usually a script). If your wordpress index file is in the root then also check within the file where the rest of wordpress file exist for another index.php file and make sure that nothing has been added to it as well.
Have you tried removing the hacked wp-stats plugin and then uploading a clean copy of it?
My wordpress got hacked, but not by this person. Somehow a script got added to my index.php file. I had to change all my ftp passwords to keep this from happening again.
