You need to check the server logs to identify how the hacker able to upload files. Lot of sites are getting hacked with FTP hacks.

Experts: Gumblar attack is alive, worse than Conficker | Security - CNET News

If you check the files/folder created by hacker you will get the date and time. Now need to check the server log, ftp and apache to see what happend on that time.