My board, too, is heavily hacked.
One thing I've been doing to make upgrades smoother and less time-consuming is to always keep a local copy of W3T on my hard drive (the copy downloaded from here); when any of the PHP components are hacked a/o modified, I make a copy of the original script, and name the copy something like 'xyz.php (mod)' ... for instance, 'newpost.php' would be changed to 'newpost.php (mod)' ... but you can use any naming convention that works for you. The point is that, when looking in any of the W3T directories, at a glance you know exactly which scripts have been hacked, and consequently what needs to be modified when you download the latest upgrade.
I'm sure there are other, equally good approaches to tracking hacks; this method has (so far) served me well. Ultimately, you simply have to weigh the benefits of having the latest, improved version of W3T against what you're currently using. 5.4.3php had enough problems (and gave me enough headaches) that the choice was clear and compelling.