The BT HH
Good to see a happy ending. I have a MK1 HH - The default security settings are atrocious - It does support AES encryption too by the way.
Somewhere in the advanced setup you can disable Plug and Pray and also disable the acceptance of packet fragments as well. Once set up; AES network encryption (sometimes called WPA2),used on modern kit does not hamper router performance too much.
The bad guys are cunning sods - As I have found out the hard way. It might be a good idea to monitor you network traffic for the future for a while just in case they come back for another go - unlikely but your can never be sure.
Your IP could change your external designated IP address if needed.
CAT III