Thanks for the response! And thanks for the advice – I'll definitely look into all those steps.
The redirects from the hacked pages are occurring automatically somehow. I guess that must've been set up by the agency that redesigned the client's website last year. They must've specified 301s for certain key pages and had all other old URLs redirect to the home page.
To answer your question, I'm using Moz for backlink analysis. Could their update be the reason I'm seeing such a drop?
BTW – Search Console shows no notifications that would relate to this issue, and no manual penalties...