In case OP reads HN: If your websites are hosted with GoDaddy, I would consider them compromised aswel.

He may say that he has left them alone, but you have no chance of knowing.