My question is how do I trace the cause of the issue? all I know is that before the site got hacked, I got an email from wordpress saying that I requested to change the admin password.
The email message gives you an idea when the hack might have appeared and that the password reset function was part of the exploit.
Where to look? Basically you can start with your server logs. Which requests were done that time? Look for POST and GET requests, some servers log actually the POST data which could be useful to find out more albeit that's not always the case.
Once an attacker gained admin access to your blog, she/he normally can modify all files on a wordpress setup. That's the price to pay for the auto-update implementation in wordpress because most files must be accessible. However in a secure setup, files are write-only. This info might help to understand how a hack can be performed and how to prevent it in the future.
Also look for wordpress updates in the 3.2.x lineup or downgrade to 3.1.4, 3.2.1 is quite new and is not that tested in the wild, especially for exploits.
Another method to track things down is to setup a honeypot install with the same configuration with full logging enabled and notifications so to learn more about attacks happenning. Many attacks are done automated for spamming purposes (or just worms) so you can use the honeypot site to detect such attack patterns. You know the site has been attacked when files have been changed or added.