One of our clients had their FTP credentials compromised causing a similar effect. It may be a decent idea to check the logs and identify if this was the method of entry.