Drupal site constantly being rehacked.

You may have done this already, however here's what I would do (for this you'll need to run a local development environment like WAMP or MAMP):

1. Export a copy of your database and download it to your local computer. I'd recommend first emptying out the sessions table, and all tables prefixed with the word "cache". Also download a copy of your files directory and download your active theme, however keep these separate for now. This is ALL you should download... core and all modules, added themes, etc should be left behind. Leave the .htaccess files, settings files, etc behind.
2. If the database isn't prohibitively huge, open the .sql file in a text editor (not sure your platform, but if you use a Mac, TextWrangler is a free editor that tends to handle large files well) and do some searching for anything related to the hack that you know of, and search for "php" to see if that occurs anywhere in the database, and why. If the file is huge, then at least try searching its contents without opening the file using you OS's search tools, or a third party tool. Once you've searched thoroughly, import into a new empty database.
3. Re-download Drupal core and all your modules directly from drupal.org. Since you appear to use Drush, that shouldn't be too hard (drush dl module1 module2 module3). While you're at it, if there are any modules you don't actually need, note those and plan on uninstalling them once the site is up and running.
4. Your theme is a bit more tricky. First though, make sure you have the latest copy of the Zen parent theme. Themes can have PHP of course so you'll need to carefully audit every file from your theme that you choose to keep. Even images can secretly hold PHP code inside. If you're very paranoid (as I would be in this case) I wouldn't trust a single thing... I'd copy and paste the text from each file into new fresh files that I recreated. You can maybe be slightly lax on assessing every single line of CSS, but you "should" assess every single line of any template file that's capable of running PHP. I would open every single image in Photoshop and see if anything odd happens. I might even re-export the image assets from the original PSD files, or at least "save as" each image and create new files.
5. Next your files directory... immediately toss all automatically generated files (CSS, JS, images from ImageCache, XMLSitemap, whatever). They can all be regenerated just fine, so rule out anything hiding in there. I'd recommend you throughly audit every file remaining if you can. At the very least, mass open bunches of images files at once and see if any have odd behavior.
6. Configure your new settings.php file to point to your new database, then visit the site. Hopefully everything comes up. Now's the time to begin uninstalling any of those modules you don't actually need. Once uninstalled, delete the module's folder.
7. Double check that a new .htaccess file has been generated for you inside your files directory.
8. If you're using the PHP input filter anywhere on your site for any reason, stop. Get rid of that thing.
9. Backup your live site one last time, then delete it completely. Every single file gone. Database completely deleted and recreated from scratch, using a different name and different password. Upload your new site and import your database. I don't know if Dreamhost support SFTP, but if at all possible do NOT use regular FTP (password and data are sent through the internet unencrypted for all to see).
10. Follow the advice on this page to get file permissions/ownership set correctly. If your host supports it, set your temp directory to /tmp, which they hopefully have set up correctly to avoid any files being executable in. If you have to use your own temp directory, make absolutely sure that the permissions are as limited as possible, and absolutely no executing permissions (both for the directory and anything in it).

When it comes down to it, this is a shared host though, so it's always possible for a misconfiguration or oversight on the host's part to allow a different customer's insecure site being hacked to compromise the whole server and all other customers, no matter how secure your own site is.

Hope this helps, and good luck!

Can you have dreamhost block his IP address? They should be able to see in the logs what IP is doing the edit. Block the IP, and he'll have to work harder to keep coming back.